CVE-2023-48712 (published 2023-11-24T17:15Z)

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin user's account. Limited users can impersonate another user's account if only single-factor authentication is configured. If a user knows an admin username, opens the login screen and attempts to authenticate with an incorrect password they can subsequently enter a valid non-admin username and password they will be logged in as the admin user. All installations prior to version 0.9.0 are affected. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/warp-tech/warpgate
commit_details: repo_url: https://github.com/warp-tech/warpgate
author: Eugene
author_date: 2023-11-23 18:35:27+01:00
msg: fixed GHSA-c94j-vqr5-3mxr - privilege escalation during web auth
repository: repo_url: https://github.com/warp-tech/warpgate
repo_name: warp-tech/warpgate
description: Smart SSH, HTTPS and MySQL bastion that requires no additional client-side software
repo_language: Rust
owner: warp-tech
file_changes: filename: auth.rs
change_type: ModificationType.MODIFY
diff: @@ -129,7 +129,7 @@ impl Api {
 
         let password_cred = AuthCredential::Password(Secret::new(body.password.clone()));
         if cp
-            .validate_credential(&body.username, &password_cred)
+            .validate_credential(&state.username(), &password_cred)
             .await?
         {
             state.add_valid_credential(password_cred);

programming_language: Rust
filename: common.rs
change_type: ModificationType.MODIFY
diff: @@ -194,16 +194,20 @@ pub async fn get_auth_state_for_request(
         }
     }
 
-    match session.get_auth_state_id() {
-        Some(id) => Ok(store.get(&id.0).ok_or(WarpgateError::InconsistentState)?),
-        None => {
-            let (id, state) = store
-                .create(None, username, crate::common::PROTOCOL_NAME)
-                .await?;
-            session.set(AUTH_STATE_ID_SESSION_KEY, AuthStateId(id));
-            Ok(state)
+    if let Some(id) = session.get_auth_state_id() {
+        let state = store.get(&id.0).ok_or(WarpgateError::InconsistentState)?;
+
+        let existing_matched = state.lock().await.username() == username;
+        if existing_matched {
+            return Ok(state);
         }
     }
+
+    let (id, state) = store
+        .create(None, username, crate::common::PROTOCOL_NAME)
+        .await?;
+    session.set(AUTH_STATE_ID_SESSION_KEY, AuthStateId(id));
+    Ok(state)
 }
 
 pub async fn authorize_session(req: &Request, username: String) -> poem::Result<()> {

programming_language: Rust