FeatherPanel Permission Bypass in SubuserController

Executive Summary

FeatherPanel versions before 1.3.7.10 have a flaw in the SubuserController updateSubuser handler where permission validation is not enforced. Authenticated subusers with minimal permissions can send a crafted request to modify their own permission records, granting themselves full server control. This allows unauthorized access to sensitive data, backups, and server configurations.

Useful 0 Not Useful 0

Detection Guidance

Check FeatherPanel version with: curl -s https://your-featherpanel-url.com/api/version | grep version. If version is below 1.3.7.10, the system is vulnerable. Inspect network traffic for POST requests to /api/subuser/update with modified permission payloads.

Useful 0 Not Useful 0

Impact Analysis

If you are a FeatherPanel user running a version before 1.3.7.10, an attacker with subuser access could escalate their privileges to gain full control over your server. This could lead to unauthorized access to sensitive data, backups, and server settings, potentially causing data breaches or system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information security). Unauthorized access to personal or health data could result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FeatherPanel to version 1.3.7.10 or later immediately. Review subuser permissions and remove any unauthorized privilege escalations. Monitor for unusual subuser activity or permission changes.

Useful 0 Not Useful 0