CVE-2022-32170

Overview

The "Bytebase" application does not restrict low privilege user to access admin "projects"

Details

The "Bytebase" application does not restrict low privilege user to access admin "projects" for which an unauthorized user can view the "projects" created by "Admin" and the affected endpoint is "/api/project?user=${userId}".

PoC Details

1. Login into the application as both "Admin" (admin@example.com:admin) and Developer "User" (user@admin.com:user) and then click on "Projects".
2. Now open "Burp suite" and turn "Intercept on" and from "admin" dashboard click on "projects" and see the "user id" of "admin" in the capture request.
3. Note the "user id" and "Forward" the request and again capture the request of "projects" from the "user" dashboard and change "user id" to "admin user id" and "Forward" the request.
4. Now "user" can see the "projects" created by "admin".

Affected Environments

Bytebase versions 0.1.0 through 1.0.4

Prevention

No fix