| tiêu đề | SpecterOps BloodHound 9.4.0 Improper Authorization |
|---|
| Mô tả | PATCH /api/v2/domains/{objectID} is a graph-write endpoint that updates a domain node's collected property, but it is authorized with a read-tier permission (GraphDBRead) instead of a write-tier one (GraphDBWrite).
As a result, roles intended to be read-only (Read-Only, Auditor) or otherwise lacking graph-write rights (User) can perform this write. The collected flag controls whether a domain is included in attack-path post-processing, so setting it to false causes that domain's attack-path edges (DCSync, ADCS ESCs, CanRDP, Owns, NTLM relay, etc.) to be deleted and not regenerated on the next analysis run, letting a low-privilege user hide attack paths from defenders.
Exploitable via both JWT session and API-key authentication.
Reproduction:
1. As a Read-Only user: PATCH /api/v2/domains/{domainSID} body {"collected":false} → HTTP 200
2. After next analysis run: MATCH ()-[r:DCSync]->() RETURN count(r) drops from 2 → 0
3. Restore collected=true + re-analyze → returns to 2
Solution:
Change the route to RequirePermissions(permissions.GraphDBWrite) (currently GraphDBRead) in cmd/api/src/api/registration/v2.go:261. |
|---|
| Người dùng | b1d0ws (UID 74336) |
|---|
| Đệ trình | 17/07/2026 21:57 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 03/09/2026 17:47 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 398471 [SpecterOps BloodHound đến 9.5.1 Graph Write Endpoint v2.go NewV2API nâng cao đặc quyền] |
|---|
| điểm | 17 |
|---|