GHSA-5f5r-95pg-xrpm: Beszel has an IDOR in hub API endpoints that read system ID from URL parameter
SummarySome API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID.System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the `containers` endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string.Affected Component**File:** `internal/hub/api.go`, lines 283–361**Endpoints:**`GET /api/beszel/containers/logs?system=SYSTEM_ID&container=CONTAINER_ID``GET /api/beszel/containers/info?system=SYSTEM_ID&container=CONTAINER_ID``GET /api/beszel/systemd/info?system=SYSTEM_ID&service=SERVICE_NAME``POST /api/beszel/smart/refresh?system=SYSTEM_ID`**Commit:** c7261b56f1bfb9ae57ef0856a0052cabb2fd3b84Vulnerable CodeThe `containerRequestHandler` function retrieves a system by ID but never verifies the authenticated user is a member of that system:The same pattern applies to `getSystemdInfo` (lines 322–340) and `refreshSmartData` (lines 342–361).Meanwhile, the standard PocketBase collection API enforces proper membership checks:These rules are only applied to the PocketBase collection endpoints, **not** to the custom routes registered on `apiAuth`.PoC**The proof:** The standard PocketBase API returns `404` (system not found) for unassigned systems. The custom endpoints resolve the system, contact the agent, and return data — proving the authorization check is missing.Step 1: Start the hubWait a few seconds, then verify:Expected: `{"message":"API is healthy.","code":200,"data":{}}`Step 2: Create User A (admin)Open `http://localhost:8090` in a browser and create the first user:Email: `usera@test.com`Password: `testpassword1`Step 3: Create User B (readonly)In the Beszel UI, go to Users and add a new user:Email: `userb@test.com`Password: `testpassword2`Role: **readonly**Step 4: Authenticate as User AStep 5: Get hub public keyStep 6: Create a universal token and start the agentFind the Docker network the hub is on:Start the agent on the **same network** so the hub can reach it:Wait a few seconds for the agent to register:Step 7: Verify User A sees the systemYou should see one system in `items`. Save the system ID:Step 8: Authenticate as User B (readonly)Verify User B sees NO systems:Expected: `"totalItems": 0`Step 9: Control test — standard API blocks User BExpected: **404** — RBAC correctly hides the system from User B.Step 10: IDOR — SMART refresh (User B triggers action on User A's system)Expected: The hub processes the request and contacts the agent. Any response (data or agent error) proves the IDOR — compare with the 404 from Step 9.Step 11: IDOR — Systemd info (User B reads from User A's system)Expected: Hub contacts the agent and returns systemd data or an agent-level error.Step 12: IDOR — Container logs (User B reads from User A's system)Container endpoints require a Docker container ID (12-64 hex chars). Get a real one from the agent's host:Step 13: IDOR — Container info (User B reads from User A's system)Impact**Container logs**: Content of recent application logs, potentially including sensitive information**Container info**: Content of Docker engine API's `/containers/{id}/json` endpoint, excluding environment variables**Systemd info**: Unit properties and status for any monitored service**SMART refresh**: Trigger a SMART data update on any system
CVSS v3.1: 3.5