UnoPim Admin ACL Bypass Leading to OAuth Integration Abuse

Executive Summary

UnoPim before version 2.1.3 has a flaw where it does not include certain routes (store, update, and key-generation) in its access control list (ACL) map. This allows admin users with minimal privileges to bypass permission checks. Attackers can exploit this to create OAuth API integrations, generate client credentials, and escalate their permissions by taking advantage of missing authorization validation in the Bouncer middleware.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your UnoPim instance is running version 2.1.2 or earlier. Verify if integration-related routes (store, update, generate_key, re_generate_secret_key) are missing from ACL configurations. Inspect Bouncer middleware logs for unauthorized access attempts to these routes. Use commands like 'curl -X POST http://<target>/admin/integrations/store' to test if write operations succeed without proper permissions.

Useful 0 Not Useful 0

Impact Analysis

If you are an admin user of an affected UnoPim instance, an attacker with minimal admin access could exploit this vulnerability to gain unauthorized permissions. This could lead to unauthorized access to sensitive data, creation of malicious integrations, or further privilege escalation within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Failure to protect sensitive data could result in legal penalties, loss of trust, and reputational damage for organizations subject to these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade UnoPim to version 2.1.3 or later to ensure proper ACL map inclusion for integration routes. Review admin user permissions to restrict unnecessary access. Audit existing OAuth integrations and client credentials for unauthorized creation.

Useful 0 Not Useful 0