Description
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | < 4.6.5 | 4.6.5 |
References
- GitHub Security Advisory (GHSA-wgjv-p9mm-qw77) vendor-advisory
- VulnCheck Advisory: Zipline before 4.6.5 TOCTOU Race Condition via /api/setup third-party-advisory