Description
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Plausible Plausible Analytics
Default version status: unaffected
0 to ≤ 3.2.1affected
References
- https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/site/traffic_change_notification.ex#L21 ↗
- https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/controllers/site_controller.ex#L481-L494 ↗
- https://abraxaslabs.tech/research/plausible-traffic-notify ↗
- https://github.com/plausible/analytics ↗
- https://www.vulncheck.com/advisories/plausible-analytics-through-3.2.1-mass-assignment-via-traffic-change-notification-update ↗