Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php

Vulnerability

Overview

A privilege escalation and authentication bypass vulnerability exists in OpenSTAManager versions 2.9.8 and earlier. The file modules/utenti/actions.php can be directly accessed without any authentication or authorization checks. The code explicitly sets $skip_permissions = true; and includes core.php, which disables all permission enforcement [2]. This allows an attacker to craft POST requests to modify user groups, including promoting an existing user to the 'Amministratori' (administrator) group.

Attack

Vector

The vulnerability is exploitable remotely by any unauthenticated attacker who can reach the OpenSTAManager instance. No authentication or cookies are required. The attacker sends a crafted POST request to the vulnerable endpoint with parameters such as idgruppo and op (operation). The advisory provides a proof-of-concept where a user named 'agent' with ID 4 can be promoted to the administrator group without any valid session [2].

Impact

Successful exploitation allows an attacker to assign administrator privileges to existing users, modify group memberships, enable or disable accounts, and perform other sensitive operations exposed in modules/utenti/actions.php. This can lead to complete compromise of the application, as an attacker can gain full administrative control over the management software [2].

Mitigation

As of the advisory publication, no patch has been released. Users should upgrade to a fixed version once available. In the meantime, administrators should restrict network access to the OpenSTAManager instance and monitor for unauthorized requests to modules/utenti/actions.php. The open source repository is available at [1] for tracking updates.