Incorrect Authorization in Camunda Admin Setup Leading to Account Takeover

Executive Summary

This vulnerability in Camunda 7.24.0 before 7.24.15 involves an authorization flaw in the Admin web application's setup endpoint. The SetupResource incorrectly checks for setup availability by only counting direct members of the camunda-admin group, rather than all configured administrators. This allows an unauthenticated attacker to exploit the flaw and create a new administrator account when the camunda-admin group is empty but the system is fully administered.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Camunda Admin web application's first-run setup endpoint is accessible without proper authorization. Verify if the camunda-admin group is empty but administrators exist. Inspect logs for unauthorized setup user creation attempts or new admin account creation events.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized administrative access to the Camunda system, leading to account takeover. This could allow the attacker to deploy malicious processes or execute scripts with the privileges of the engine's service user, potentially compromising the entire system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and control of sensitive data, violating compliance requirements for GDPR and HIPAA. Unauthorized administrative access may result in data breaches, unauthorized processing, or disclosure of protected health information, leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Camunda to version 7.24.15 or later to address the authorization flaw in the Admin web application's setup endpoint.

Useful 0 Not Useful 0