smart-sso PermissionFilter flaw lets any logged-in user become admin
A login-sharing program lets ordinary users make themselves admins.
Summary
smart-sso through 2.0.1's PermissionFilter allows any unlisted path by default, so any logged-in user can call admin console APIs. An attacker can make themselves an administrator, reset passwords, and manage users and applications across integrated systems.
Affected when
- a user account that can log in
- admin paths not listed in the permission table
What to do
No fixed version is named in the sources. Check that you run a version newer than 2.0.1 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
Times
First published
First seen