bbs-go AdminMiddleware Permission Bypass Leading to DoS

Executive Summary

This vulnerability is a permission bypass in bbs-go through version 4.4.6. The issue occurs in the AdminMiddleware authorization logic where a read-only permission rule incorrectly matches the /api/admin/user/synccount endpoint before the intended write-level permission rule. This allows authenticated users with only view permissions to trigger expensive full-table user recounts and cache invalidations.

Useful 0 Not Useful 0

Detection Guidance

Check if the /api/admin/user/synccount endpoint is accessible with read-only permissions. Monitor for repeated calls to this endpoint causing high database load. Inspect admin permission rules in bbs-go's admin_permission_registry.go for wildcard rules preceding specific endpoint rules.

Useful 0 Not Useful 0

Impact Analysis

An attacker with view-only access could repeatedly call the synccount endpoint, causing denial of service through database overload. This leads to performance degradation, system unavailability, or resource exhaustion for legitimate users.

Useful 0 Not Useful 0

Mitigation Strategies

Update bbs-go to a version where the permission rules are corrected. Ensure specific endpoint rules like /api/admin/user/synccount are ordered before wildcard rules in admin_permission_registry.go. Restrict access to admin endpoints to only necessary users.

Useful 0 Not Useful 0