Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
Affects poweradmin/poweradminSource GCVE Database
- Patch
- Available – fixed in 4.2.5, 4.3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagistpoweradmin/poweradmin | Affected
| Fixed in
|
| Packagistpoweradmin/poweradmin | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Restrict API access to trusted users only and avoid granting the 'user_edit_others' permission to non-superusers. Monitor for updates from the Poweradmin maintainers and apply patches promptly once released. Do not rely on the API for user management if this vulnerability is present.
Description
Poweradmin contains a vulnerability in its REST API user-update endpoint that allows users with the 'user_edit_others' permission, but not superuser status, to reset any user's password, including superusers. This bypasses the application's intended permission checks enforced in the web interface, enabling privilege escalation and full account takeover of the superuser account. The API does not verify if the target user is a superuser nor checks for the 'user_passwd_edit_others' permission before allowing password changes. This inconsistency leads to a critical security flaw allowing non-admin users to gain full administrative control.
Impact
A user with the 'user_edit_others' permission but without superuser privileges can reset the password of any account, including superusers, via the API. This leads to full privilege escalation and complete account takeover of the superuser account. The vulnerability undermines the intended permission model and allows unauthorized administrative access, potentially compromising the entire system's security and integrity.
Summary
The Poweradmin REST API user-update endpoint (PUT/PATCH /api/v2/users/{id} and the V1 equivalent) fails to enforce two key authorization rules that the web interface enforces: preventing non-superusers from editing superuser accounts and requiring a separate permission to change other users' passwords. The API's canEditUser() method grants users with 'user_edit_others' permission the ability to edit all users, including superusers, without restriction. Additionally, the updateUser() method updates passwords without verifying the 'user_passwd_edit_others' permission. This allows a non-admin user with 'user_edit_others' permission to reset the superuser's password and take over the superuser account, resulting in full privilege escalation. The web UI explicitly blocks these actions, but the API is inconsistent, creating a serious security gap.
Weaknesses
References
- github.com/poweradmin/poweradmin/security/advisories/GHSA-h4hf-v6w5-897x (opens in a new tab)
- github.com/poweradmin/poweradmin/commit/36e9081a5c83cb962dc6275b7adcd6cb463f1028 (opens in a new tab)
- github.com/poweradmin/poweradmin/commit/9bdda77bc103f283a0babcaf3355f3f95b360122 (opens in a new tab)
- github.com/poweradmin/poweradmin/commit/b90fd83e67e6d7b6ad6c9be3a1c0d2f45bd73b6c (opens in a new tab)
- github.com/poweradmin/poweradmin/commit/ffb95d5201cad5cb38e3eabc4f8103cac2ca18e2 (opens in a new tab)
- github.com/poweradmin/poweradmin (opens in a new tab)
- github.com/poweradmin/poweradmin/releases/tag/v4.2.5 (opens in a new tab)
- github.com/poweradmin/poweradmin/releases/tag/v4.3.4 (opens in a new tab)