| 제목 | Open-Source LitmusChaos 3.19.0 Authorization Bypass via LocalStorage |
|---|
| 설명 | An authorization bypass vulnerability was identified in the LitmusChaos platform, where an authenticated user can escalate their privileges and gain owner-level access to a project by manipulating the projectID value stored in the browser's LocalStorage. This occurs due to the absence of proper backend validation for project ownership and user authorization.
The LitmusChaos platform stores the projectID in the browser’s LocalStorage, which can be freely modified by the client. Upon modifying this value to reference a different project, the application fails to verify whether the user is authorized to access or control the new project. As a result, the attacker is able to perform privileged operations—such as editing configurations, deleting resources, or inviting users—on a project they do not own.
This design flaw shifts critical access control logic to the client side, violating standard security practices and enabling unauthorized privilege escalation. |
|---|
| 원천 | ⚠️ https://github.com/MaiqueSilva/VulnDB/blob/main/readme04.md |
|---|
| 사용자 | maique (UID 88562) |
|---|
| 제출 | 2025. 07. 31. AM 04:11 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 08. 09. AM 07:34 (9 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 319322 [LitmusChaos Litmus 까지 3.19.0 LocalStorage projectID 권한 상승] |
|---|
| 포인트들 | 20 |
|---|