| शीर्षक | Open-Source LitmusChaos 3.19.0 Unauthorized Project Deletion via Missing Authorization Checks |
|---|
| विवरण | A critical vulnerability was identified in the LitmusChaos platform that allows any authenticated user to delete projects belonging to other users by manipulating the projectID parameter in a DELETE request. This occurs due to the absence of proper authorization checks on the backend.
Details
During testing, it was observed that when a user sends a request to delete a project, the backend accepts any valid projectID and proceeds with deletion without verifying if the user is authorized to perform the action. Specifically, the backend does not validate whether the requesting user is the owner or has sufficient privileges over the target project.
This flaw enables malicious users to craft requests with arbitrary projectID values, leading to the deletion of projects they do not own or manage.
Impact
Permanent deletion of other users' projects
Loss of critical data and disruption of service
Exploitable by any authenticated user |
|---|
| स्रोत | ⚠️ https://github.com/MaiqueSilva/VulnDB/blob/main/readme06.md |
|---|
| उपयोगकर्ता | maique (UID 88562) |
|---|
| सबमिशन | 31/07/2025 04:30 AM (1 वर्ष पहले) |
|---|
| संयम | 09/08/2025 07:34 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 319324 [LitmusChaos Litmus तक 3.19.0 Delete Request /auth/delete_project/ projectID अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|