MCO Authorization Bypass Exposes ACL Tree Structure

Compliance Impact

The vulnerability in MyComplianceOffice (MCO) allows an authenticated, low-privileged user to retrieve administrator access control structures without proper authorization checks. This exposure of sensitive permission mappings and internal configuration details could potentially undermine the integrity and confidentiality of compliance management processes.

Since MCO is a compliance management platform designed to help organizations meet regulatory obligations, such unauthorized access could impact the effectiveness of compliance controls required by standards like GDPR and HIPAA. Specifically, unauthorized disclosure of access control structures may increase the risk of data breaches or misuse of sensitive information, which are critical concerns under these regulations.

However, the provided information does not explicitly state the direct impact on compliance certifications or legal obligations under GDPR, HIPAA, or other standards.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a low-privileged authenticated user to retrieve administrator-level access control information.

This exposure can lead to unauthorized disclosure of sensitive permission mappings and internal configuration details, potentially aiding attackers in escalating privileges or planning further attacks.

Useful 0 Not Useful 0

Executive Summary

This vulnerability occurs because MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint.

As a result, an authenticated user with low privileges can access administrator access control structures without the necessary permissions.

This improper enforcement may expose sensitive permission mappings and internal configuration details.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint, allowing a low-privileged authenticated user to retrieve administrator access control structures.

To detect this vulnerability on your system, you can attempt to access the vulnerable endpoint with a low-privileged user account and observe if the response includes administrator access control structures without proper authorization.

A possible command using curl to test this could be:

• curl -i -X GET -b 'session_cookie=your_session_cookie' https://[MCO_SERVER]/customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure

Replace [MCO_SERVER] with your server address and provide a session cookie for a low-privileged authenticated user. If the response contains administrator ACL data, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint to only authorized administrator users and monitoring access logs for suspicious activity involving the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint.

Since the vulnerability is confirmed in version 25.3.3.1 and vendor contact attempts were unsuccessful, consider applying any available patches or updates if released, or implementing network-level controls such as firewall rules to limit access to the affected endpoint.

Additionally, review user privileges and ensure that low-privileged users do not have unnecessary access to sensitive API endpoints.

Useful 0 Not Useful 0