Authenticated User Privilege Escalation in Snipe-IT

Executive Summary

This vulnerability is a privilege escalation flaw in Snipe-IT, an IT asset management system. An authenticated user with users.create permission can create a new user and assign admin privileges by submitting the admin permission during user creation. The store() method in UsersController.php strips superuser permission but fails to remove admin permission, allowing unauthorized privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Check Snipe-IT version with: grep -r "version" /path/to/snipe-it/config/app.php. If version is below 8.6.0, the system is vulnerable. Review user creation logs in app/Http/Controllers/Users/UsersController.php for unauthorized admin permission assignments.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with basic user permissions to gain full administrative access to the Snipe-IT system. This could lead to unauthorized data access, modification, or deletion of sensitive IT asset information, license details, and user accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information security). Unauthorized admin access may result in data breaches, non-compliance penalties, and loss of trust in systems handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.0 or later immediately. Review all user accounts created by non-superusers before the upgrade for unauthorized admin permissions. Remove admin privileges from any suspicious accounts.

Useful 0 Not Useful 0