Description
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Webreaper Damselfly
Default version status: unaffected
0 to ≤ 4.5.3affected
pkg:github/Webreaper/DamselflyReferences
- https://hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization ↗
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53 ↗
- https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242 ↗
- https://github.com/Webreaper/Damselfly/issues/409 ↗
- https://www.vulncheck.com/advisories/webreaper-damselfly-through-4.5.3-missing-authentication-on-rest-api-controllers ↗