Accessory Record Creation in Snipe-IT Allows Company ID Manipulation

Executive Summary

This vulnerability exists in the Snipe-IT IT asset/license management system when the Full Multiple Companies Support (FMCS) feature is enabled. It allows a low-privileged authenticated user from one company to create accessory records under another company by supplying a foreign company_id value in the API request. The root cause is that the Accessories API create path mass-assigns request parameters directly to the Accessory model, including the company_id, without enforcing tenant isolation. This means a user from Company A can inject accessory records into Company B's inventory, compromising the integrity of company-scoped data.

The vulnerability is a cross-tenant data injection issue due to lack of proper company context enforcement in the API controller during accessory creation, unlike the web controller which enforces company scoping. This flaw was fixed in version 8.6.2 of Snipe-IT.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users from one company to create or inject accessory records into another company's inventory. This compromises the integrity and trustworthiness of your asset management data, as users from other companies can add unauthorized or misleading records.

Such unauthorized data injection can lead to confusion, mismanagement of assets, and potential operational disruptions. It represents a tenant isolation failure, meaning that company boundaries are not properly enforced, which could also lead to further security risks if exploited.

The vulnerability has a high severity rating with a CVSS score of 8.5, indicating a significant impact on data integrity and potential availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a low-privileged authenticated user being able to create accessory records under another company by supplying a foreign company_id in API requests when Full Multiple Companies Support (FMCS) is enabled.

To detect this vulnerability on your system, you can monitor API requests to the Accessories API create path for suspicious or unauthorized company_id values that do not match the authenticated user's company.

Specifically, you can look for API calls where the company_id parameter is set to a company different from the user's own company ID.

Suggested commands or methods include:

• Review API logs for POST requests to the Accessories API create endpoint containing company_id parameters.
• Use grep or similar tools to filter logs for company_id values that do not match the authenticated user's company.
• Example command: grep 'POST /api/accessories' /var/log/snipeit/api.log | grep -v 'company_id=<user_company_id>'

Additionally, audit accessory records in the database to identify any that are assigned to companies inconsistent with the creating user's company.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Snipe-IT to version 8.6.2 or later, where this vulnerability has been fixed.

The fix enforces that the company_id for new accessory records is automatically set to the current user's company ID during creation and update operations, preventing unauthorized cross-company assignments.

If upgrading immediately is not possible, consider temporarily disabling Full Multiple Companies Support (FMCS) to prevent cross-tenant data injection.

Also, review and restrict API access permissions to ensure only trusted users have access to accessory creation endpoints.

Monitor logs for suspicious activity as described in the detection section to identify potential exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a low-privileged authenticated user from one company to create accessory records under another company when Full Multiple Companies Support (FMCS) is enabled. This cross-tenant data injection compromises the integrity of company-scoped inventory data by allowing unauthorized data creation in another company's context.

Such a tenant isolation failure can lead to unauthorized data manipulation and potential exposure of company-specific information, which may conflict with compliance requirements in standards like GDPR and HIPAA that mandate strict data segregation, integrity, and access controls.

By allowing unauthorized users to inject data into another company's records, the vulnerability undermines data integrity and access control principles critical to regulatory compliance, potentially increasing the risk of non-compliance with data protection regulations.

Useful 0 Not Useful 0