Leak of User Credentials via JSON-RPC in Leantime

Executive Summary

The vulnerability exists in Leantime's Users::getUser method within the JSON-RPC API, where it lacks proper authorization checks.

This flaw allows authenticated users to retrieve full user credential information, including password hashes, TOTP (Time-based One-Time Password) secrets, and session tokens.

Attackers can exploit this by calling the users.getUser method with arbitrary user IDs to enumerate all accounts and obtain sensitive credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or suspicious calls to the JSON-RPC API method `users.getUser` with arbitrary user IDs, especially from authenticated users who should not have access to other users' credentials.

Network detection can involve inspecting API request logs or network traffic for repeated or unusual `users.getUser` calls that enumerate multiple user IDs.

Suggested commands to detect exploitation attempts include:

• Using grep or similar tools on server logs to find calls to `users.getUser` with different user IDs, e.g., `grep 'users.getUser' /path/to/api/logs | sort | uniq -c`
• Using network monitoring tools like tcpdump or Wireshark to filter JSON-RPC traffic and inspect payloads for `users.getUser` method calls.
• Example tcpdump command to capture HTTP POST requests to the API endpoint: `tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'users.getUser'`

Additionally, reviewing application logs for unusual access patterns or multiple user ID queries by the same authenticated user can help detect exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including:

• Attackers can perform offline password cracking using the obtained password hashes.
• They can bypass two-factor authentication (2FA) by accessing TOTP secrets.
• Session hijacking is possible by stealing session tokens.
• Overall, it enables attackers to compromise user accounts and potentially gain unauthorized access to the system.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Leantime's Users::getUser method allows authenticated users to retrieve sensitive user credentials, including password hashes, two-factor authentication secrets, and session tokens. This exposure of sensitive personal and security-related information can lead to unauthorized access and account takeover.

Such unauthorized disclosure of personal and authentication data can violate data protection requirements under common standards and regulations like GDPR and HIPAA, which mandate the protection of personal data and secure authentication mechanisms.

Specifically, the exposure of password hashes and TOTP secrets increases the risk of offline password cracking and two-factor authentication bypass, undermining the confidentiality and integrity of user data, which are core principles in these regulations.

Therefore, this vulnerability could lead to non-compliance with these standards due to insufficient access controls and inadequate protection of sensitive user information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the `users.getUser` JSON-RPC API method to only authorized users with the appropriate `users.view` permission or limiting it to self-only access.

Remove or strip sensitive fields such as password hashes, two-factor authentication secrets (plaintext TOTP seeds), session tokens, and password reset tokens from API responses to prevent credential disclosure.

Apply the security patch that modifies the `Users::getUser` service to exclude sensitive fields from responses, as implemented in the fix commit 4f2612d13e0e8a2093092a846b44506cf133b671.

If patching immediately is not possible, consider temporarily disabling or restricting access to the vulnerable API endpoint to prevent exploitation.

Monitor for suspicious activity and enforce strong authentication and authorization controls to reduce risk.

Useful 0 Not Useful 0