| tiêu đề | aiyiyi121 SxDevOps 1.1 Privilege Escalation |
|---|
| Mô tả | SxDevOps UserSerializer includes is_superuser, is_staff, and is_active in Meta.fields, but read_only_fields only protects date_joined and last_login. The update() method iterates over all validated_data fields via setattr(), allowing any user with rbac.user.manage permission to set is_superuser=True on any account including their own, bypassing the entire RBAC permission system.
Vulnerable code in backend/rbac/serializers.py lines 122-164:
class UserSerializer(serializers.ModelSerializer):
class Meta:
model = User
fields = [..., 'is_superuser', 'is_staff', 'is_active', ...]
read_only_fields = ('date_joined', 'last_login') # NOT is_superuser!
def update(self, instance, validated_data):
for attr, value in validated_data.items():
setattr(instance, attr, value) # is_superuser=True gets set directly
Exploitation: PATCH /api/users/2/ {"is_superuser": true, "is_staff": true}
Impact: Complete RBAC bypass. Attackers can create backdoor superuser accounts and gain full system control. |
|---|
| Nguồn | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| Người dùng | _lxf (UID 63911) |
|---|
| Đệ trình | 24/08/2026 04:48 (cách đây 28 ngày) |
|---|
| Kiểm duyệt | 19/09/2026 12:15 (26 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 407927 [aiyiyi121 SxDevOps 1.0/1.1 UserSerializer serializers.py update nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|