Users can add themselves to any organization in CloudExplorer Lite

Vulnerability

CloudExplorer Lite, an open source cloud management tool, contains a missing permission check in the user profile functionality. The server does not validate whether the requesting user is allowed to select or change their organization membership. Affected versions: <= 1.0.2 [1].

Exploitation

An attacker with a valid user account can modify their own profile. On the interface, only the user's current organization is visible, but by intercepting the request (e.g., with Burp Suite) and replacing the organization ID with that of a target organization not assigned to the user, the server executes the request without verifying that the user is authorized for the new organization [1]. The attacker needs network access to intercept and modify API requests.

Impact

Successful exploitation allows a user to add themselves to any organization in the system, gaining membership and potentially inheriting roles and permissions associated with that organization, leading to unauthorized access to resources and data that should be restricted.

Mitigation

The vulnerability is fixed in version v1.1.0 [1]. Users should upgrade to v1.1.0 or later. No other workarounds are available.