| タイトル | Open-Source LitmusChaos 3.19.0 Broken Access Control via Login Response Manipulation |
|---|
| 説明 | A broken access control vulnerability was identified in the LitmusChaos platform, where a user can gain unauthorized access to another user's project by manipulating the projectID returned in the response of the /auth/login endpoint. This flaw results from excessive trust in client-side data and a lack of server-side validation after authentication.
Details
Upon successful authentication, the /auth/login response includes a list of accessible project IDs and the user's role for each. This information is stored on the client side and is used by the frontend to determine access and visibility to projects.
However, by intercepting and modifying this response, specifically the projectID value, a malicious user can inject unauthorized project references. The backend fails to verify whether the user truly has access to the referenced project, thus allowing privilege escalation and access to resources beyond their scope.
This weakness violates the principle of secure-by-default access control and exposes internal project data across user boundaries. |
|---|
| ソース | ⚠️ https://github.com/MaiqueSilva/VulnDB/blob/main/readme05.md |
|---|
| ユーザー | maique (UID 88562) |
|---|
| 送信 | 2025年07月31日 04:19 (1 年 ago) |
|---|
| モデレーション | 2025年08月09日 07:34 (9 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 319323 [LitmusChaos Litmus 迄 3.19.0 /auth/login projectID 特権昇格] |
|---|
| ポイント | 20 |
|---|