Unauthorized File Deletion in Zammad via AttachmentsController

Executive Summary

Zammad is a helpdesk system. Prior to version 7.1.2, an action called destroy_form in AttachmentsController could delete temporary file uploads without verifying ownership. An attacker with a user's pending-upload UUID could silently remove those files before the victim submits a ticket or article.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized deletion of UploadCache Store records in Zammad versions prior to 7.1.2. Monitor logs for the destroy_form action on AttachmentsController with mismatched form_id and user ownership. Check for unexpected file deletions in temporary upload directories before ticket submission.

Useful 0 Not Useful 0

Impact Analysis

If you use Zammad before version 7.1.2, an attacker could delete your temporary file uploads before you submit them. This could cause data loss for pending tickets or articles, requiring you to re-upload files and potentially delaying support requests.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance by causing loss of data integrity for pending support requests. GDPR requires data integrity and availability, while HIPAA requires safeguards for protected health information. Data loss could violate these requirements if sensitive information is lost.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zammad to version 7.1.2 or later immediately. Review and restrict access to the destroy_form action in AttachmentsController. Implement logging and alerts for suspicious deletion attempts. Verify no unauthorized deletions occurred in temporary uploads before upgrading.

Useful 0 Not Useful 0