Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
The advisory, in context
Impact
The store() method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges.
The users.create permission may commonly be delegated to HR staff, department leads, or similar roles.
Patches
Patched in aea3877718
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 8.6.0
Fixed in 8.6.0
276 explicitly affected versions
3.2.0, v0.1.0, v0.1.1, v0.1.2, v0.2.0, v0.3.0-alpha, v0.3.10-alpha, v0.3.11-alpha, v0.3.7-alpha, v0.3.8-alpha, v0.3.9-alpha, v1.0, v1.1, v1.2.0, v1.2.1, v1.2.10, v1.2.11, v1.2.2, v1.2.3, v1.2.3-beta, v1.2.4, v1.2.4-beta, v1.2.5, v1.2.6, v1.2.6-beta, v1.2.6.1, v1.2.7, v1.2.7-beta, v1.2.8, v1.2.9, v2.0, v2.0-RC-1, v2.0-beta, v2.0.1, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.1.0, v2.1.1, v2.1.2, v3.0, v3.0-alpha, v3.0-alpha2, v3.0-beta.1, v3.0-beta.2, v3.0-beta.3, v3.0.0-beta, v3.1.0, v3.3.0, v3.3.0-beta, v3.4, v3.4.0-alpha, v3.4.0-beta, v3.5.0, v3.5.0-beta, v3.5.0-beta2, v3.5.1, v3.5.2, v3.6.0, v3.6.1, v3.6.2, v3.6.3, v3.6.4, v3.6.5, v3.6.6, v4-beta3, v4-beta4, v4.0, v4.0-alpha, v4.0-alpha-2, v4.0-beta, v4.0-beta2, v4.0-beta5, v4.0-beta6, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.0-beta, v4.1.0-beta2, v4.1.1, v4.1.10, v4.1.11, v4.1.12, v4.1.13, v4.1.14, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9, v4.2.0, v4.3.0, v4.4.0, v4.4.1, v4.5.0, v4.6.0, v4.6.1, v4.6.10, v4.6.11, v4.6.12, v4.6.13, v4.6.14, v4.6.15, v4.6.16, v4.6.17, v4.6.18, v4.6.2, v4.6.3, v4.6.4, v4.6.5, v4.6.6, v4.6.7, v4.6.8, v4.6.9, v4.7.0, v4.7.1, v4.7.2, v4.7.3, v4.7.4, v4.7.5, v4.7.6, v4.7.7, v4.7.8, v4.8.0, v4.9.0, v4.9.1, v4.9.2, v4.9.3, v4.9.4, v4.9.5, v5.0.0, v5.0.0-beta-1.0, v5.0.0-beta-1.1, v5.0.0-beta-2, v5.0.0-beta-3.0, v5.0.0-beta-4, v5.0.0-beta-5, v5.0.1, v5.0.10, v5.0.11, v5.0.12, v5.0.2, v5.0.3, v5.0.4, v5.0.5, v5.0.6, v5.0.7, v5.0.8, v5.0.9, v5.1.0, v5.1.1, v5.1.2, v5.1.3, v5.1.4, v5.1.5, v5.1.6, v5.1.7, v5.1.8, v5.2.0, v5.3.0, v5.3.1, v5.3.10, v5.3.2, v5.3.3, v5.3.4, v5.3.5, v5.3.6, v5.3.7, v5.3.8, v5.3.9, v5.4.0, v5.4.1, v5.4.2, v5.4.3, v5.4.4, v6.0.0, v6.0.0-RC-1, v6.0.0-RC-2, v6.0.0-RC-3, v6.0.0-RC-4, v6.0.0-RC-5, v6.0.0-RC-6, v6.0.0-RC-7, v6.0.0-RC-8, v6.0.1, v6.0.10, v6.0.11, v6.0.12, v6.0.13, v6.0.14, v6.0.2, v6.0.3, v6.0.4, v6.0.5, v6.0.6, v6.0.7, v6.0.8, v6.0.9, v6.1.0, v6.1.1, v6.1.2, v6.2.0, v6.2.1, v6.2.2, v6.2.3, v6.3.0, v6.3.1, v6.3.2, v6.3.3, v6.3.4, v6.4.0, v6.4.1, v6.4.2, v7.0.0, v7.0.1, v7.0.10, v7.0.11, v7.0.12, v7.0.13, v7.0.2, v7.0.3, v7.0.4, v7.0.5, v7.0.6, v7.0.7, v7.0.8, v7.0.9, v7.1.14, v7.1.15, v7.1.16, v7.1.17, v8.0.0, v8.0.1, v8.0.2, v8.0.3, v8.0.4, v8.1.0, v8.1.1, v8.1.15, v8.1.16, v8.1.17, v8.1.18, v8.1.2, v8.1.3, v8.1.4, v8.2.0, v8.2.1, v8.3.0, v8.3.1, v8.3.2, v8.3.3, v8.3.4, v8.3.5, v8.3.6, v8.3.7, v8.4.0, v8.4.1, v8.5.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.2.0",
"v0.1.0",
"v0.1.1",
"v0.1.2",
"v0.2.0",
"v0.3.0-alpha",
"v0.3.10-alpha",
"v0.3.11-alpha",
"v0.3.7-alpha",
"v0.3.8-alpha",
"v0.3.9-alpha",
"v1.0",
"v1.1",
"v1.2.0",
"v1.2.1",
"v1.2.10",
"v1.2.11",
"v1.2.2",
"v1.2.3",
"v1.2.3-beta",
"v1.2.4",
"v1.2.4-beta",
"v1.2.5",
"v1.2.6",
"v1.2.6-beta",
"v1.2.6.1",
"v1.2.7",
"v1.2.7-beta",
"v1.2.8",
"v1.2.9",
"v2.0",
"v2.0-RC-1",
"v2.0-beta",
"v2.0.1",
"v2.0.2",
"v2.0.3",
"v2.0.4",
"v2.0.5",
"v2.0.6",
"v2.1.0",
"v2.1.1",
"v2.1.2",
"v3.0",
"v3.0-alpha",
"v3.0-alpha2",
"v3.0-beta.1",
"v3.0-beta.2",
"v3.0-beta.3",
"v3.0.0-beta",
"v3.1.0",
"v3.3.0",
"v3.3.0-beta",
"v3.4",
"v3.4.0-alpha",
"v3.4.0-beta",
"v3.5.0",
"v3.5.0-beta",
"v3.5.0-beta2",
"v3.5.1",
"v3.5.2",
"v3.6.0",
"v3.6.1",
"v3.6.2",
"v3.6.3",
"v3.6.4",
"v3.6.5",
"v3.6.6",
"v4-beta3",
"v4-beta4",
"v4.0",
"v4.0-alpha",
"v4.0-alpha-2",
"v4.0-beta",
"v4.0-beta2",
"v4.0-beta5",
"v4.0-beta6",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.0-beta",
"v4.1.0-beta2",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.12",
"v4.1.13",
"v4.1.14",
"v4.1.2",
"v4.1.3",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9",
"v4.2.0",
"v4.3.0",
"v4.4.0",
"v4.4.1",
"v4.5.0",
"v4.6.0",
"v4.6.1",
"v4.6.10",
"v4.6.11",
"v4.6.12",
"v4.6.13",
"v4.6.14",
"v4.6.15",
"v4.6.16",
"v4.6.17",
"v4.6.18",
"v4.6.2",
"v4.6.3",
"v4.6.4",
"v4.6.5",
"v4.6.6",
"v4.6.7",
"v4.6.8",
"v4.6.9",
"v4.7.0",
"v4.7.1",
"v4.7.2",
"v4.7.3",
"v4.7.4",
"v4.7.5",
"v4.7.6",
"v4.7.7",
"v4.7.8",
"v4.8.0",
"v4.9.0",
"v4.9.1",
"v4.9.2",
"v4.9.3",
"v4.9.4",
"v4.9.5",
"v5.0.0",
"v5.0.0-beta-1.0",
"v5.0.0-beta-1.1",
"v5.0.0-beta-2",
"v5.0.0-beta-3.0",
"v5.0.0-beta-4",
"v5.0.0-beta-5",
"v5.0.1",
"v5.0.10",
"v5.0.11",
"v5.0.12",
"v5.0.2",
"v5.0.3",
"v5.0.4",
"v5.0.5",
"v5.0.6",
"v5.0.7",
"v5.0.8",
"v5.0.9",
"v5.1.0",
"v5.1.1",
"v5.1.2",
"v5.1.3",
"v5.1.4",
"v5.1.5",
"v5.1.6",
"v5.1.7",
"v5.1.8",
"v5.2.0",
"v5.3.0",
"v5.3.1",
"v5.3.10",
"v5.3.2",
"v5.3.3",
"v5.3.4",
"v5.3.5",
"v5.3.6",
"v5.3.7",
"v5.3.8",
"v5.3.9",
"v5.4.0",
"v5.4.1",
"v5.4.2",
"v5.4.3",
"v5.4.4",
"v6.0.0",
"v6.0.0-RC-1",
"v6.0.0-RC-2",
"v6.0.0-RC-3",
"v6.0.0-RC-4",
"v6.0.0-RC-5",
"v6.0.0-RC-6",
"v6.0.0-RC-7",
"v6.0.0-RC-8",
"v6.0.1",
"v6.0.10",
"v6.0.11",
"v6.0.12",
"v6.0.13",
"v6.0.14",
"v6.0.2",
"v6.0.3",
"v6.0.4",
"v6.0.5",
"v6.0.6",
"v6.0.7",
"v6.0.8",
"v6.0.9",
"v6.1.0",
"v6.1.1",
"v6.1.2",
"v6.2.0",
"v6.2.1",
"v6.2.2",
"v6.2.3",
"v6.3.0",
"v6.3.1",
"v6.3.2",
"v6.3.3",
"v6.3.4",
"v6.4.0",
"v6.4.1",
"v6.4.2",
"v7.0.0",
"v7.0.1",
"v7.0.10",
"v7.0.11",
"v7.0.12",
"v7.0.13",
"v7.0.2",
"v7.0.3",
"v7.0.4",
"v7.0.5",
"v7.0.6",
"v7.0.7",
"v7.0.8",
"v7.0.9",
"v7.1.14",
"v7.1.15",
"v7.1.16",
"v7.1.17",
"v8.0.0",
"v8.0.1",
"v8.0.2",
"v8.0.3",
"v8.0.4",
"v8.1.0",
"v8.1.1",
"v8.1.15",
"v8.1.16",
"v8.1.17",
"v8.1.18",
"v8.1.2",
"v8.1.3",
"v8.1.4",
"v8.2.0",
"v8.2.1",
"v8.3.0",
"v8.3.1",
"v8.3.2",
"v8.3.3",
"v8.3.4",
"v8.3.5",
"v8.3.6",
"v8.3.7",
"v8.4.0",
"v8.4.1",
"v8.5.0"
]
}