| tiêu đề | dolibarr erp 23.0.3 Full Admin Takeover via User Clone Privilege Escalation |
|---|
| Mô tả | summery
Full Admin Takeover via critical IDOR (Insecure Direct Object Reference) vulnerability exists in the user cloning endpoint (/htdocs/user/card.php). Any authenticated user with the generic "clone users" permission can clone the root/superadmin account (ID 1) by simply changing the id parameter in the URL. The clone inherits all root permissions, granting the attacker full administrative control over the entire ERP system
. As we can see on the frontend interface, the system does NOT allow cloning the root/superadmin user (the clone button is missing or disabled). However, the backend does NOT enforce this restriction. By directly tampering with the id parameter in the URL, any authenticated user with the generic "clone users" permission can clone the root/superadmin account (ID 1). The clone inherits all root permissions, granting the attacker full administrative control over the entire ERP system.
frontend UI, the system only allows cloning of non-admin users. The clone button is available for standard users but is missing or disabled for the root/superadmin user (ID 1)
Steps to Reproduce :
Log in as a non-root user who has the "clone users" permission.
Send the following request (cloning a normal user, ID 11):
GET /dolibarr/htdocs/user/card.php?id=11&action=confirm_clone&confirm=yes&token=[TOKEN]&clone_name=&clone_rights=&clone_categories= HTTP/1.1
Host: localhost:8888
Change id=11 to id=1 (root):
GET /dolibarr/htdocs/user/card.php?id=1&action=confirm_clone&confirm=yes&token=[SAME_TOKEN]&clone_name=&clone_rights=&clone_categories= HTTP/1.1
Host: localhost:8888
The system clones the root user. Log in with the newly created clone. It has all root permissions.
Impact :
Full privilege escalation: any user with clone rights becomes a Super Administrator.
Complete system takeover: attacker can view/modify/delete all data, manage users, change system settings, and export sensitive information.
No audit trail: the cloned account may go undetected.
Root Cause
The endpoint checks for the generic "clone users" permission but never verifies if the logged-in user is authorized to clone the specific target user (especially protected accounts).
The CSRF token is bound to the session, not to the target id, so it does not mitigate this IDOR.
Recommended Fix
Add an authorization check to ensure the cloner has rights to clone the specific target user.
Explicitly block cloning of root/superadmin accounts (ID 1 and other protected IDs) for non-root users.
Bind the CSRF token to the target user ID (e.g., hash(session + user_id + action)).
Log all clone operations with source and target IDs
Vendor Acknowledgment:
The vulnerability was reported via Dolibarr's GitHub issue tracker
(Issue #39000). The vendor acknowledged the issue, labeled it as Bug, and
immediately pushed a fix in commit 798e653, closing the issue as
completed within hours of the report.
Fix commit: https://github.com/Dolibarr/dolibarr/commit/798e65356ede03c2812ab1a728f23fae34de5592
GitHub Issue: https://github.com/Dolibarr/dolibarr/issues/39000
|
|---|
| Nguồn | ⚠️ https://github.com/Dolibarr/dolibarr/issues/39000 |
|---|
| Người dùng | Abderrahmane Aksoum (UID 97571) |
|---|
| Đệ trình | 28/06/2026 13:44 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 15/08/2026 08:01 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 390181 [Dolibarr đến 23.0.3 User Cloning htdocs/user/card.php ID nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|