إرسال #556201: Casbin Casdoor v1.430.0-v1.812.0 Authorization Bypassالمعلومات

عنوانCasbin Casdoor v1.430.0-v1.812.0 Authorization Bypass
الوصفAll versions of this IAM product released between Oct 2023 and Jan 2025 are vulnerable to a remote attacker creating an admin account without authenticating. The endpoint to create SCIM users is simply lacking authentication middleware, creating a SCIM user will associate a corresponding local user. To use the exploit, issue a POST request to `/scim/Users`: ``` {"active":true,"displayName":"Admin","emails":[{"value":"[email protected]"}],"password":"cool-password"} ``` The developers silently issued a fix: https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe Developers have not responded to email, on Discord they responded by kicking me. This is being actively exploited in the wild.
المستخدم
 krav (UID 84007)
ارسال11/04/2025 12:13 AM (1 سنة منذ)
الاعتدال02/05/2025 12:45 PM (22 days later)
الحالةتمت الموافقة
إدخال VulDB307180 [Casdoor حتى 1.811.0 SCIM User Creation Endpoint controllers/scim.go HandleScim تجاوز الصلاحيات]
النقاط17

Do you know our Splunk app?

Download it now for free!