Critical · published February 8, 2024
🚨 An authenticated user can suddenly wield admin-level power! That’s right, with a crafty payload, any regular member can promote themselves or others to 'root' in OpenObserve's user management. 🔥 It's like a hotel where every guest has been given a master key without proper checks. One sneaky guest could unlock every room and access anything, completely undermining the security of the entire establishment. This vulnerability allows any ordinary user to elevate their privileges, potentially leading to unauthorized control over sensitive application resources and data. Imagine the chaos if someone with ill intentions gains root access—they could access, modify, or even delete critical logs and metrics, wreaking absolute havoc on your observability platform!
It's like a hotel where every guest has been given a master key without proper checks. One sneaky guest could unlock every room and access anything, completely undermining the security of the entire establishment. The flaw exists in the '/api/{org_id}/users' endpoint where the user creation process fails to validate assigned roles properly. An authenticated user can manipulate the payload to grant themselves or others elevated privileges, including the highly sensitive 'root' role.
This vulnerability allows any ordinary user to elevate their privileges, potentially leading to unauthorized control over sensitive application resources and data. Imagine the chaos if someone with ill intentions gains root access—they could access, modify, or even delete critical logs and metrics, wreaking absolute havoc on your observability platform! Upgrade OpenObserve to version 0.8.0 immediately to close this critical security hole. Ensure to review role assignments and tighten your user management protocols to avoid any unauthorized privilege escalation in the future. You've got this! With a quick upgrade and a careful review, you'll secure your platform and keep your data safe! 🛡️