Snipe-IT Asset Model Request Bypass

Executive Summary

This is a business logic bypass vulnerability in Snipe-IT asset management software versions before 8.7.0. It allows authenticated users to request asset models that are explicitly marked as non-requestable by exploiting a flaw in the POST /account/request/asset_model/{modelId} endpoint. The server fails to validate the requestable flag for asset models, enabling users to bypass administrative restrictions and create checkout requests for restricted models.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Snipe-IT versions before 8.7.0 by running commands like 'composer show snipe/snipe-it' or checking the version in the web interface. Monitor for unusual checkout requests for non-requestable asset models in the admin panel or database logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated users to submit requests for non-requestable asset models, potentially spamming admin approval queues with unnecessary requests. While it doesn't automatically grant access to restricted assets, it undermines access control policies and creates extra administrative overhead for manual approval processes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it does not involve unauthorized data access or disclosure. However, it could indirectly affect compliance by undermining access control policies, potentially leading to unauthorized asset requests that may require manual administrative review, increasing administrative burden and potential delays in approval processes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Snipe-IT to version 8.7.0 or later. Review recent checkout requests for non-requestable asset models and revoke any unauthorized requests. Ensure the {itemType} route parameter is restricted to valid values to prevent further bypass attempts.

Useful 0 Not Useful 0