Description
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/{id} to render PDFs of other departments' tickets, including full conversation threads.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| faveosuite | faveo-helpdesk | ≤ 2.0.3 | — |
References
- GitHub Issue #8369 issue-tracking
- https://github.com/faveosuite/faveo-helpdesk product
- https://github.com/faveosuite/faveo-helpdesk/commit/408076c7fa921133920decceec306b194affdcee patch
- faveo-helpdesk v2.0.4.RC.1 Release Notes release-notes
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L490 technical-description
- VulnCheck Advisory: Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print third-party-advisory