جزئیات آسیب‌پذیری

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0.

• https://github.com/zammad/zammad/security/advisories/GHSA-p3mg-2jxr-hww2 x_refsource_CONFIRM
• https://github.com/zammad/zammad/commit/e50ef69beab897317caa5e9490edba33aa1ac978 x_refsource_MISC
• https://github.com/zammad/zammad/commit/f059eb2d9835bdc2666750e805631f67ff485642 x_refsource_MISC
• https://github.com/zammad/zammad/releases/tag/7.0.2 x_refsource_MISC
• https://github.com/zammad/zammad/releases/tag/7.1.0 x_refsource_MISC