Critical · published April 5, 2024
🚨 Unauthenticated attackers can create admin accounts in Webhood with a simple HTTP request! That's like letting anyone walk into a secured office and claim the manager's desk because the door was left wide open! 🔥 Think of it as a restaurant where the chef forgot to lock the kitchen door. Anyone can just waltz in, use the chef's tools, and even make themselves a free meal — that's essentially what this vulnerability allows! An attacker could gain full control over the Webhood deployment, able to access sensitive data, manipulate settings, and potentially launch further attacks. This could lead to devastating data breaches or unauthorized changes that put users at risk.
Think of it as a restaurant where the chef forgot to lock the kitchen door. Anyone can just waltz in, use the chef's tools, and even make themselves a free meal — that's essentially what this vulnerability allows! This Missing Authentication for Critical Function vulnerability in Webhood's backend allows unauthenticated users to create an admin account via the Pocketbase admin API, which lacks proper authentication checks when no existing admin accounts are present.
An attacker could gain full control over the Webhood deployment, able to access sensitive data, manipulate settings, and potentially launch further attacks. This could lead to devastating data breaches or unauthorized changes that put users at risk. Upgrade your Webhood deployment to version 0.9.1 or higher immediately to patch this vulnerability. As a temporary workaround, consider disabling access to the `/api/admins` endpoint to prevent exploitation until you can upgrade. Remember to create an admin account to secure your deployment! You've got this! Follow these steps and your Webhood will be back in secure hands in no time! 🛡️