Description
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Peppermint-Lab peppermint
Default version status: unaffected
0 to ≤ 0.5.5affected
pkg:github/Peppermint-Lab/peppermintReferences
- https://hackmd.io/@hieuPenguinnn/peppermint-data-logs-missing-authorization ↗
- https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/time.ts#L6-L27 ↗
- https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/storage.ts#L9-L35 ↗
- https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/main.ts#L57-L70 ↗
- https://www.vulncheck.com/advisories/peppermint-through-0.5.5-missing-authorization-via-time-tracking-and-attachment-upload-endpoints ↗