Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
This bypasses the stricter permission model enforced in group-management paths and enables delegated user-management permissions to escalate target users to administrator-equivalent privilege.
Would have made an awesome CTF challenge ^^!
Check out the advisory here!
Summary
PATCH /api/v3/core/users/{pk}/ allows a caller with change_user on a target user to assign arbitrary groups through UserSerializer, including groups with is_superuser=True, without requiring enable_group_superuser.This bypasses the stricter permission model enforced in group-management paths and enables delegated user-management permissions to escalate target users to administrator-equivalent privilege.
Impact
Users with permissions to update groups or permissions to update users are able to add themselves or other users they have permissions on to users which have superuser permissions.Would have made an awesome CTF challenge ^^!
Check out the advisory here!
