PT-2021-19436 · Pwndoc · Pwndoc

Sascha Brendel · Published 2021-07-19 · Updated 2022-07-12 · CVE-2021-31590

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PwnDoc versions prior to 0.4.0

Description The issue is related to incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken used for authentication and authorization, a user can maintain admin privileges even after being downgraded to a "user" privilege. Furthermore, even after a user's account is deleted, the user can still access the administration panel, add or delete users, and has complete access to the system.

Recommendations For versions prior to 0.4.0, update to version 0.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of JSON Webtokens for authentication and authorization until a patch is available. Restrict access to the administration panel to minimize the risk of exploitation. Avoid using the JSON Webtoken for users who have been downgraded to "user" privilege or have had their accounts deleted.

Exploit

Fix

Related Identifiers

CVE-2021-31590

Affected Products

Pwndoc

References · 11

• 🔥 https://dgc.org/responsible_disclosure_pwndoc_jwt · Exploit
• https://github.com/pwndoc/pwndoc/pull/128 · Patch
• https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23 · Patch
• https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121ab · Patch
• https://github.com/pwndoc/pwndoc/pull/74 · Patch
• https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939d · Patch
• https://osv.dev/vulnerability/CVE-2021-31590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31590 · Security Note
• https://github.com/pwndoc/pwndoc/security/advisories · Note
• https://t.me/cvenotify/18314 · Telegram Post
• https://t.me/cvenotify/17886 · Telegram Post