Ghostfolio PUT Endpoint Permission Bypass via Impersonation-Id Header

Impact Analysis

This vulnerability can impact you by allowing attackers with read-only access to modify your portfolio holding tags without permission.

• Unauthorized modification of portfolio tags.
• Corruption of portfolio categorization.
• Distortion of portfolio reports and filters.

Such unauthorized changes can lead to inaccurate investment insights and mismanagement of your portfolio data.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in Ghostfolio affects the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint. It fails to properly verify the Access.permissions field when processing the Impersonation-Id header. This flaw allows users who only have read-only access to modify portfolio holding tags.

Attackers with valid read-only share tokens can exploit this vulnerability to assign or remove tags on another user's portfolio holdings. This unauthorized modification can corrupt portfolio categorization and reports.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized modification of portfolio holding tags via the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint when using the Impersonation-Id header without proper permission checks.

To detect exploitation attempts on your network or system, you can monitor HTTP PUT requests to the affected endpoint and check for the presence of the Impersonation-Id header in requests made by users with read-only access.

Suggested commands include using network traffic inspection tools or web server logs to filter for such requests. For example, using curl or similar tools to simulate or detect suspicious requests:

• Check web server logs for PUT requests to the endpoint: grep 'PUT /api/v1/portfolio/holding/' /var/log/nginx/access.log
• Filter requests containing the Impersonation-Id header: grep 'Impersonation-Id' /var/log/nginx/access.log
• Use curl to test if a read-only token can modify tags (replace placeholders accordingly): curl -X PUT -H "Authorization: Bearer <read-only-token>" -H "Impersonation-Id: <id>" -d '{"tags": ["test"]}' https://<ghostfolio-host>/api/v1/portfolio/holding/<dataSource>/<symbol>/tags

Additionally, monitoring for unexpected changes in portfolio holding tags or reports may indicate exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating Ghostfolio to a version that contains the fix for this vulnerability.

The vulnerability has been fixed in commit 697ef59, which adds proper verification of the Access.permissions field when processing the Impersonation-Id header.

If updating immediately is not possible, consider restricting or disabling the use of the Impersonation-Id header or limiting read-only share tokens to prevent unauthorized tag modifications.

Also, review and monitor portfolio holding tags for unauthorized changes and revoke or rotate any read-only share tokens that may have been compromised.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows users with read-only access to modify portfolio holding tags without proper authorization checks. This unauthorized modification can lead to corrupted portfolio categorization and reports.

While the provided information does not explicitly mention compliance with standards such as GDPR or HIPAA, unauthorized data modification and improper access control could potentially violate principles of data integrity and access management required by such regulations.

Therefore, this vulnerability may impact compliance by undermining data integrity and access control policies, which are critical components in many regulatory frameworks.

Useful 0 Not Useful 0