Improper Authorization in Pangolin through v1.20.0

Executive Summary

This vulnerability is an improper authorization issue in the Pangolin platform (version 1.20.0 or earlier). An authenticated remote attacker can reuse a valid access token issued for one resource to gain unauthorized access to any other resource in any organization. This happens because the authentication handler does not verify the target resource ID when validating tokens.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the authWithAccessToken.ts file in your Pangolin deployment for the absence of resourceId validation during token verification. Check logs for unauthorized access attempts or tokens being reused across different resources. Monitor for sessions created without proper resource scoping.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows attackers to bypass access controls and access sensitive resources they are not authorized to use. This could lead to data breaches, unauthorized system access, or further lateral movement within a network. The high CVSS score (9.6) indicates a critical risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR (data confidentiality) and HIPAA (secure access to health data). Unauthorized access risks exposing regulated data, leading to legal penalties, fines, or loss of certification.

Useful 0 Not Useful 0

Mitigation Strategies

Update Pangolin to the latest version where this issue is fixed. Ensure all access tokens are scoped to specific resources and validate resourceId during token verification. Rotate all existing tokens and review access logs for suspicious activity.

Useful 0 Not Useful 0