amjadali-110/cve-2023-43317Escalação Vertical de Privilégios via Armazenamento de Sessão por Amjad Ali (CVE-2023-43317)
Um usuário normal pode elevar seus privilégios por meio do parâmetro userPermissionsLIst no componente Session Storage. para obter acesso não autorizado a recursos e funcionalidades de nível administrativo. Isso pode levar a acesso não autorizado a dados, modificação de dados e outras ações normalmente restritas a administradores.
[{"permissionId":1,"permissionName":"CanGetApplicants"},{"permissionId":5,"permissionName":"CanGetUsers"},{"permissionId":8,"permissionName":"CanGetApplications"},{"permissionId":9,"permissionName":"CanResendEmails"},{"permissionId":18,"permissionName":"CanGetCustomers"},{"permissionId":22,"permissionName":"CanGetUserActivity"}]
[{"permissionId":1,"permissionName":"CanGetApplicants"},{"permissionId":2,"permissionName":"CanCreateApplicants"},{"permissionId":3,"permissionName":"CanUpdateApplicants"},{"permissionId":4,"permissionName":"CanManageAccounts"},{"permissionId":5,"permissionName":"CanGetUsers"},{"permissionId":6,"permissionName":"CanCreateUsers"},{"permissionId":7,"permissionName":"CanUpdateUsers"},{"permissionId":8,"permissionName":"CanGetApplications"},{"permissionId":9,"permissionName":"CanResendEmails"},{"permissionId":10,"permissionName":"CanGetDocuments"},{"permissionId":11,"permissionName":"CanUploadDocuments"},{"permissionId":12,"permissionName":"CanCreateIndividualInvitations"},{"permissionId":14,"permissionName":"CanQueryIndividualInvitations"},{"permissionId":15,"permissionName":"CanGetBulkInvitations"},{"permissionId":16,"permissionName":"CanUploadBulkInvitationsFile"},{"permissionId":17,"permissionName":"CanUpdateFormStatus"},{"permissionId":18,"permissionName":"CanGetCustomers"},{"permissionId":19,"permissionName":"CanResendInvitations"},{"permissionId":20,"permissionName":"CanResendEvaluations"},{"permissionId":21,"permissionName":"CanResendManualReviews"},{"permissionId":22,"permissionName":"CanGetUserActivity"},{"permissionId":23,"permissionName":"CanGetDeliveredDocuments"},{"permissionId":24,"permissionName":"CanGetBillingTables"},{"permissionId":25,"permissionName":"CanGetBillingTableHistoricalRecords"},{"permissionId":26,"permissionName":"CanGetBillingTableDraftUpdateRecords"},{"permissionId":27,"permissionName":"CanGetFeedBacks"},{"permissionId":28,"permissionName":"CanUpdateBillingTables"},{"permissionId":29,"permissionName":"CanUpdateUserEmail"},{"permissionId":30,"permissionName":"CanGetTemplates"},{"permissionId":31,"permissionName":"CanResendApplicationEmail"},{"permissionId":32,"permissionName":"CanDeleteUpcomingUpdates"},{"permissionId":33,"permissionName":"CanCreatePolls"},{"permissionId":34,"permissionName":"CanGetPolls"},{"permissionId":35,"permissionName":"CanUpdatePolls"},{"permissionId":36,"permissionName":"CanNotifyIndividualinvitations"},{"permissionId":37,"permissionName":"CanSendInvitationEmail"}]
https://amjadali110.medium.com/a-easy-vertical-privilege-escalation-via-session-storage-cfa9f558c94