Description
ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API tokens for 30-day normal session tokens that bypass API token expiry and allowlists.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
mayswind ezBookkeeping
Default version status: unaffected
1.2.0 to < 2.0.1affected
pkg:golang/github.com/mayswind/ezbookkeepingReferences
- https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wq25-mpcf-2mfc ↗
- https://github.com/mayswind/ezbookkeeping/commit/9a92b07be8a7034665abfdb35b036210a1d57bf9 ↗
- https://github.com/mayswind/ezbookkeeping/releases/tag/v2.0.1 ↗
- https://github.com/mayswind/ezbookkeeping/blob/v2.0.0/pkg/api/tokens.go#L327-L380 ↗
- https://github.com/mayswind/ezbookkeeping ↗
- https://www.vulncheck.com/advisories/mayswind-ezbookkeeping-1.2.0-before-2.0.1-privilege-escalation-via-token-refresh-endpoint ↗