Privilege Escalation in FOSSBilling via API Permission Manipulation

Executive Summary

This vulnerability affects FOSSBilling versions prior to 0.8.0. It allows a low-privileged staff user, who only has the permission to create and edit staff, to escalate their privileges by granting themselves arbitrary module permissions through the admin API.

Specifically, such a user can call the endpoint /api/admin/staff/permissions_update targeting their own account and modify any permission structure, bypassing the intended role-based access control.

This results in persistent privilege escalation, meaning the user can maintain elevated permissions beyond their original scope.

The issue is patched in version 0.8.0, and some workarounds include restricting the staff.create_and_edit_staff permission to highly trusted staff members or using a reverse proxy or WAF to limit access to the permissions update API.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized privilege escalation within the FOSSBilling system.

A low-privileged staff user could gain higher-level permissions, potentially allowing them to access sensitive billing and client management functions that should be restricted.

Such unauthorized access could result in data manipulation, unauthorized changes to billing information, or disruption of client management processes.

Overall, it compromises the security and integrity of the billing system and could lead to broader organizational risks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FOSSBilling to version 0.8.0 or later, which contains the patch for this issue.

If upgrading immediately is not possible, restrict the permission 'staff.create_and_edit_staff' to only highly trusted staff members.

Additionally, use a reverse proxy or Web Application Firewall (WAF) to restrict access to the endpoint '/api/admin/staff/permissions_update' to specific trusted roles.

Useful 0 Not Useful 0