Authentication Bypass in Damselfly via Disabled Authorization

Executive Summary

This vulnerability is an authentication bypass in Webreaper Damselfly through version 4.5.3. Unauthenticated attackers can access all /api/* routes because authorization attributes in controllers are commented out. Attackers can create admin accounts via PUT /api/users or reset any user's password via POST /api/users, gaining full system control.

Useful 0 Not Useful 0

Detection Guidance

Check if Damselfly version 4.5.3 or earlier is installed by inspecting the application files or logs. Verify if API endpoints like /api/users are accessible without authentication by sending unauthenticated requests to /api/users. Look for commented-out [Authorize] attributes in controller files such as UserManagementController.cs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full administrative access to your Damselfly instance, create new admin accounts, reset passwords of existing users, read or modify all user data, delete or move files, and alter system settings. This could lead to complete data compromise or denial of service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict access controls and data protection; HIPAA requires safeguards for protected health information. Unauthorized access and data breaches resulting from this flaw could lead to regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Damselfly to a version that restores authorization attributes in controllers. If upgrading is not possible, manually uncomment the [Authorize] attributes in all API controllers. Ensure JWT secret keys are not hardcoded and rotate any exposed keys. Restrict network access to the API endpoints if possible.

Useful 0 Not Useful 0