Description
OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | REMS | ≤ 1.0.0 | — |
References
- https://gist.github.com/neelkotnis/e11fb4f70d8ec850fa601566b95472a4 technical-description exploit
- REMS by OpsTree Product Page product
- VulnCheck Advisory: OpsTree REMS through 1.0.0 Reporter Spoofing via /api/v1/incidents third-party-advisory