Description
Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
puemos Craftplan
Default version status: unaffected
0 to ≤ 0.7.5affected
pkg:github/puemos/craftplanReferences
- https://hackmd.io/@hieuPenguinnn/craftplan-customer-public-write ↗
- https://github.com/puemos/craftplan/blob/v0.7.5/lib/craftplan/crm/customer.ex#L91-L94 ↗
- https://github.com/puemos/craftplan/blob/v0.7.5/lib/craftplan/accounts/checks/api_scope_check.ex#L33-L40 ↗
- https://github.com/puemos/craftplan ↗
- https://www.vulncheck.com/advisories/craftplan-through-0.7.5-missing-authorization-via-crm-customer-json-api-and-graphql ↗