ZenTao PMS Authorization Bypass via Comment Editing

Executive Summary

ZenTao PMS through version 22.6 has an authorization bypass flaw in the action::editComment function. Authenticated users can exploit this by providing arbitrary action IDs to read or overwrite comments belonging to other users. Attackers can sequentially guess action IDs to modify comments on bugs, stories, tasks, and documents in projects they lack access to, potentially viewing sensitive content and attachments.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor ZenTao PMS logs for unauthorized access attempts to edit comments. Check for sequential actionID requests in HTTP logs that modify comments outside user permissions. Use network traffic analysis to identify unusual API calls to action::editComment endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you use ZenTao PMS versions up to 22.6, an attacker with valid credentials could access or alter comments in projects they shouldn't have permission to view. This could lead to data leaks, unauthorized changes to project details, or manipulation of collaborative content, affecting project integrity and confidentiality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data in comments, or HIPAA by exposing protected health information if stored in ZenTao PMS. Compliance failures may occur due to unauthorized data disclosure or modification, potentially leading to legal penalties or loss of certification.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ZenTao PMS to the latest version beyond 22.6. Implement strict access controls to restrict comment modification permissions. Review and audit all comment edits in logs for suspicious activity. Consider disabling the action::editComment feature if not critical.

Useful 0 Not Useful 0