Business Logic Errors in answerdev/answer

Vulnerability

Overview

The vulnerability is a business logic error within Answer, an open-source Q&A platform. In versions prior to 1.0.6, the UpdateUserPassword function in the admin service lacked a critical check to prevent an administrator from changing the password of another administrator or any user. This flaw is rooted in the absence of a restriction ensuring that an admin can only modify their own password [1][3].

Exploitation

An authenticated administrator could exploit this flaw by sending a crafted request to the password update endpoint, specifying a different user ID than their own. No additional authentication or privileges beyond those of a standard admin user are required to trigger the vulnerability. The attacker does not need to possess any secret or token belonging to the victim user [3][4].

Impact

A successful exploitation allows an attacker with admin privileges to change the password of any other user, including other administrators. This could lead to account takeover, privilege escalation, or denial of service if critical accounts are locked out. The vulnerability undermines the authentication and authorization controls of the platform, enabling a malicious insider or compromised admin to gain control over the entire system [1][4].

Mitigation

The issue has been fixed in Answer version 1.0.6. The patch, identified in commit 15390adbfcd5fd37af4661f992f8873ae5a6b840, adds a check that rejects any password update attempt where the target user ID matches the requesting admin's user ID [3]. Users are strongly advised to upgrade to the latest version and review their current admin accounts for any unauthorized changes.