Zulip up to 6.1 /etc/zulip/settings.py improper authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in Zulip up to 6.1. This affects an unknown part of the file /etc/zulip/settings.py. The manipulation results in improper authorization. This vulnerability is known as CVE-2023-28623. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Zulip up to 6.1. Affected is an unknown functionality of the file /etc/zulip/settings.py. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AUTHENTICATION_BACKENDS` in `/etc/zulip/settings.py` and 2: The organization permissions don't require invitations to join. An attacker can create a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory. The impact is limited to installations which have this specific combination of authentication backends as described above in addition to having `Invitations are required for joining this organization` organization permission disabled. This issue has been addressed in version 6.2. Users are advised to upgrade. Users unable to upgrade may enable the `Invitations are required for joining this organization` organization permission to prevent this issue.

The weakness was published 05/20/2023 as GHSA-7p62-pjwg-56rv. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-28623 since 03/20/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 6.2 eliminates this vulnerability. Applying the patch 3df1b4dd7c210c21deb6f829df19412b74573f8d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Zulip

Version

• 6.0
• 6.1

License

• open-source

Website

• Product: https://github.com/zulip/zulip/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion