Description
Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| killbill | killbill | ≤ 0.24.21 | — |
References
- GitHub Issue #2251 issue-tracking
- https://github.com/killbill/killbill product
- AdminResource.java at killbill-0.24.21 technical-description
- VulnCheck Advisory: Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints third-party-advisory