Broken Access Control in GazellePW via API User Endpoint

Executive Summary

This is a Broken Access Control vulnerability in GazellePW (GazellePosterWall). It allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the API user endpoint using req=disable or req=enable actions with a normal user-created API token.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API requests to the GazellePW user endpoint for suspicious actions like req=disable or req=enable. Check logs for unprivileged users performing these actions using normal API tokens. Review user account status changes for unauthorized modifications.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid user account could disable other users' accounts, disrupting service availability or causing denial of service. They could also re-enable disabled accounts, potentially bypassing account suspension or access revocation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of user accounts, potentially violating data protection requirements under GDPR and HIPAA. Unprivileged users gaining control over accounts may result in unauthorized data exposure or manipulation, which conflicts with compliance mandates for access control and user privacy.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the req=disable and req=enable actions in the API user endpoint for GazellePW. Review all user accounts for unauthorized changes and revoke any suspicious API tokens. Update to a patched version if available.

Useful 0 Not Useful 0