Broken Access Control in GazellePW IP Lock Manager

Executive Summary

GazellePW (GazellePosterWall) has a Broken Access Control vulnerability in its IP lock manager. This flaw allows remote authenticated users to manipulate IP lock entries for any account through a specific endpoint (tools.php?action=iplock). They can add, modify, or delete these entries without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

Check web server access logs for requests to tools.php with the action=iplock parameter. Look for unusual IP lock modifications or additions from authenticated users.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials could bypass IP-based restrictions, lock legitimate users out of their accounts, or grant unauthorized access to specific IPs. This could lead to account compromise, data theft, or disruption of service for targeted users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and user authentication protections. It may lead to unauthorized data access or breaches, potentially resulting in regulatory penalties under GDPR, HIPAA, or other frameworks.

Useful 0 Not Useful 0

Mitigation Strategies

Remove or restrict access to tools.php. Update GazellePW to a patched version if available. Review and audit all IP lock entries for unauthorized changes.

Useful 0 Not Useful 0