Weakness (CWE)
CWE-639: Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
More detail
It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
How to prevent it (3 mitigations)
-
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
-
Architecture and Design, Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
-
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
Source: MITRE CWE-639
3,334 results · Feed
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
-
Medium 6.5
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can export other users' plant information.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can hijack other users' devices and potentially control them.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain other users' charger information.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers).
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can query an API endpoint and get device details.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").
-
High 7.5
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can change registered email addresses of other users and take over arbitrary accounts.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can infer the existence of usernames in the system by querying an API.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can obtain a user's plant list by knowing the username.
-
Medium 5.3
Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An authenticated attacker can obtain any plant name by knowing the plant ID.
-
Medium 5.3
Growatt Cloud Applications Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can check the existence of usernames in the system by querying an API.
-
High 8.7
Insecure Direct Object Reference en Deporsite de T-INNOVA
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint.
-
High 8.7
Insecure Direct Object Reference on Deporsite by T-INNOVA
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint.
-
Medium 5.3
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member…
-
Medium 4.3
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() d…
-
Medium 6.5
DNN allows a registered user to enumerate and access files they should not have access to
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This…
-
High 8.8
Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email in the 'st_…
-
High 7.5
An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows una…
-
Medium 5.4
WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.
-
Medium 4.9
WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in themeglow JobBoard Job listing job-board-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoard Job listing: from n/a through <= 1.2.8.
-
Medium 4.3
WordPress Support Genix plugin <= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.11.
-
High 7.5
NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers …
-
High 8.1
Improper Access Control in gaizhenbiao/chuanhuchatgpt
A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and lack of access control mechanisms, enabling attackers to vi…
-
High 8.8
Improper Access Control in lunary-ai/lunary
In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized users to view sensitive …
-
Medium 6.5CVE-2024-9617 Scanner template
IDOR in danswer-ai/danswer
An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to vie…
-
Medium 4.3
Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint…
-
Critical 9.4
Improper Access Control in danny-avila/librechat
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt I…