CVE-2024-46627 - Incorrect access control in BECN DATAGERRY v2.2 allows attackers to > execute arbitrary commands via crafted web requests.

DATAGERRY v2.2 lacks access control in the REST API for the following endpoints:

/rest/users/<id>/settings/ (GET, POST)

/rest/users/<id>/settings/<setting> (DELETE, PUT)

This allows an attacker to read settings, create settings, delete settings, and update settings of any user without authentication.

Additional information

• To reproduce this it's possible to use the docker setup here: https://datagerry.readthedocs.io/en/latest/admin_guide/setup.html (as of 25th Sept 2024).
• It's possible to determine valid payloads from the information here: https://datagerry.readthedocs.io/en/latest/api/rest/user-management.html#settings
• See the following for repro steps with pictures: https://daly.wtf/cve-2024-46627-incorrect-access-control-in-becn-datagerry-v2-2-allows-attackers-to-execute-arbitrary-commands-via-crafted-web-requests/

This is expected to be fixed in the next release.

Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46627