Privilege Escalation in FOSSBilling via Admin API

Executive Summary

This vulnerability affects FOSSBilling versions prior to 0.8.0. It allows low-privileged staff accounts to perform unauthorized actions through admin API endpoints. The issue arises because the 'can_always_access' module flag grants all staff access to certain modules, combined with insufficient permission checks or unsafe parameter handling on individual endpoints.

Version 0.8.0 of FOSSBilling contains a fix for this vulnerability.

Workarounds include restricting staff accounts to only those who need access to sensitive settings and using a reverse proxy or WAF to limit access to affected endpoints to trusted IP addresses or higher-privilege roles.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring access to specific admin API endpoints that lack proper authorization checks in affected FOSSBilling versions prior to 0.8.0.

You can look for suspicious or unauthorized requests to endpoints such as:

• /api/admin/system/get_params
• /api/admin/extension/config_get
• /api/admin/profile/destroy_sessions
• /api/admin/security/ip_lookup

To detect exploitation attempts on your system or network, you can use commands to search your web server logs or monitor live traffic for access to these endpoints. For example, using grep on Apache or Nginx logs:

• grep "/api/admin/system/get_params" /var/log/nginx/access.log
• grep "/api/admin/extension/config_get" /var/log/nginx/access.log
• grep "/api/admin/profile/destroy_sessions" /var/log/nginx/access.log
• grep "/api/admin/security/ip_lookup" /var/log/nginx/access.log

Additionally, monitoring for unusual activity from low-privileged staff accounts accessing these endpoints or performing administrative actions can help identify exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow low-privileged staff members to perform unauthorized administrative actions, potentially leading to unauthorized changes or access within the billing and client management system.

Such unauthorized actions could compromise the integrity and confidentiality of billing data and client information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows low-privileged staff accounts to perform unauthorized actions, including reading sensitive system settings such as bank account numbers, API keys, and internal notes, as well as accessing decrypted extension configurations exposing credentials. Such unauthorized access to sensitive and personal data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

The breach of confidentiality, integrity, and availability caused by these authorization flaws increases the risk of non-compliance with standards that mandate safeguarding sensitive data and ensuring proper access controls.

Mitigations such as restricting staff accounts to only those who need access to sensitive settings and using reverse proxies or WAFs to limit access to affected endpoints are recommended to help maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should restrict staff accounts to only those who need access to sensitive settings.

Additionally, use a reverse proxy or Web Application Firewall (WAF) to restrict access to the affected admin API endpoints to trusted IP addresses or higher-privilege roles.

Upgrading to FOSSBilling version 0.8.0 or later is recommended, as it contains a fix for this issue.

Useful 0 Not Useful 0