Privilege Escalation in InvoicePlane via User Type Manipulation

Executive Summary

InvoicePlane 1.7.2 has an authorization flaw in Users::form() where a Secondary Administrator (user_type=1, user_id != 1) can change the Primary Administrator's user_type to 2 (Guest/read-only). This removes the Primary Administrator's privileges and locks them out of the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a Secondary Administrator (user_type=1, user_id != 1) exploiting a lack of authorization checks in InvoicePlane 1.7.2 to downgrade the Primary Administrator's privileges. To detect it, inspect user accounts for unexpected changes in user_type or user_id values in the database. Check for multiple accounts with user_type=1 and verify the legitimate Primary Administrator's user_id remains unchanged.

Useful 0 Not Useful 0

Impact Analysis

If exploited, a Secondary Administrator could take over the Primary Administrator account, gain full control of the InvoicePlane instance, and prevent the legitimate owner from accessing their own system. This could lead to data loss, unauthorized invoice or payment modifications, and disruption of billing operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and audit trails for sensitive data like invoices and client information. Unauthorized privilege changes may lead to unauthorized access, data breaches, or inability to maintain proper records, potentially resulting in regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to InvoicePlane instances to trusted users only. Review and audit all user accounts, especially those with Secondary Administrator privileges (user_type = 1). Disable or remove any unauthorized Secondary Administrator accounts.

Useful 0 Not Useful 0