Description
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| faveosuite | faveo-helpdesk | ≤ 2.0.3 | — |
References
- GitHub Issue #8368 issue-tracking
- https://github.com/faveosuite/faveo-helpdesk product
- https://github.com/faveosuite/faveo-helpdesk/blob/v2.0.3/app/Http/Controllers/Agent/helpdesk/TicketController.php#L2230-L2300 technical-description
- https://github.com/faveosuite/faveo-helpdesk/commit/487a2c33912d701fc04bdb857775fea122ce20d1 patch
- https://github.com/faveosuite/faveo-helpdesk/commit/70faee621b5c3c88a34e79ad2eb1f0be17e63078 patch
- VulnCheck Advisory: Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController third-party-advisory