Privilege Escalation in rConfig via Unvalidated Role Assignment

Executive Summary

rConfig before version 8.2.8 has a privilege escalation vulnerability where authenticated users can assign any role to any account through the Users API. The role field was not properly validated, allowing attackers to bypass restrictions and grant the Admin role to any user, including themselves. This occurs due to missing allowlist validation and lack of admin-level authorization checks in the StoreUserRequest function.

Useful 0 Not Useful 0

Detection Guidance

Check rConfig logs for suspicious user creation or role modification events. Look for API calls to /api/v1/users with role fields containing arbitrary values like 'Admin' assigned by non-admin users. Review user role assignments in the database for unexpected Admin role grants.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials could escalate their privileges to Admin, gaining access to privileged features and potentially taking control of the system. This could lead to unauthorized data access, configuration changes, or further exploitation of the system. The exploit requires low privileges and no user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control. GDPR and HIPAA mandate strict access controls and audit logging; privilege escalation could result in unauthorized data exposure or modification, leading to regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rConfig to version 8.2.8 or later immediately. Review all user accounts for unauthorized Admin role assignments. Monitor for unusual privilege escalation attempts. Restrict API access to trusted networks until patched.

Useful 0 Not Useful 0