Admin Role Enumeration in Oppia via Unauthorized GET Request

Executive Summary

This vulnerability in Oppia allows any registered user to access the AdminRoleHandler GET endpoint without proper authorization. The endpoint is decorated with open_access, enabling attackers to query it with filter_criterion parameters and retrieve sensitive data like usernames with specific roles, banned status, and managed topic identifiers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the AdminRoleHandler GET endpoint in core/controllers/admin.py is accessible without proper authorization. Use tools like curl to query the endpoint with filter_criterion parameters. Example: curl -X GET 'http://<target>/adminrolehandler?filter_criterion=role'

Verify if any registered user can retrieve sensitive role information, banned flags, or managed topic identifiers. Monitor logs for unauthorized access attempts to admin endpoints.

Useful 0 Not Useful 0

Impact Analysis

Attackers can enumerate privileged accounts and roles, exposing usernames of moderators or admins. This information could be used for social engineering, credential stuffing, or targeted attacks against high-privilege users, though it does not allow direct data modification.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Oppia to a patched version beyond 3.5.2. Restrict access to the AdminRoleHandler GET endpoint by implementing proper authorization checks in the decorator.

Review and update all admin endpoint decorators to ensure they enforce authentication and authorization. Temporarily disable the endpoint if an update is not immediately possible.

Useful 0 Not Useful 0