| शीर्षक | Openboxes v0.9.7 Server-Side Request Forgery |
|---|
| विवरण | A Privilege Escalation vulnerability exists in OpenBoxes versions v0.9.7 and earlier. An authenticated user with Manager privileges (a non-administrative role) can exploit improper role-based access control in the `user/save` and `user/update` endpoints to create new users and assign them `ROLE_ADMIN`. Due to missing authorization checks in `RoleInterceptor.groovy` and a lack of role assignment validation in `UserController.groovy`, Manager users can escalate their privileges to full administrator access. Successful exploitation allows attackers to create persistent administrator accounts, gain unrestricted access to system data and configuration, and fully compromise the application.
This vulnerability was fixed in OpenBoxes v0.9.8.
timeline:
January 11, 2026 – Vulnerability discovered and reported to the OpenBoxes maintainers.
February 2, 2026 – Vulnerability acknowledged by the development team.
June 13, 2026 – Security patch officially released, fixing the unvalidated URL.openStream() call.
patch and fix: https://github.com/openboxes/openboxes/pull/5948
github advisory (not published) used to report: https://github.com/openboxes/openboxes/security/advisories/GHSA-9rrw-fx2p-p2q7 |
|---|
| स्रोत | ⚠️ https://gist.github.com/nedlir/2bc3a6e5bd4d67b863223e1bfc2e4390 |
|---|
| उपयोगकर्ता | nedlir (UID 95981) |
|---|
| सबमिशन | 27/06/2026 03:34 PM (2 महीनों पहले) |
|---|
| संयम | 15/08/2026 07:47 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390179 [OpenBoxes तक 0.9.7 Role Interceptor RoleInterceptor.groovy needManager अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|