Description
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
hcengineering Huly Platform
Default version status: unaffected
0 to ≤ 0.7.432affected
pkg:github/hcengineering/platformReferences
- https://hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization ↗
- https://github.com/hcengineering/platform/issues/10914 ↗
- https://github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts#L2921-L2939 ↗
- https://github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9 ↗
- https://www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergespecifiedpersons-rpc ↗