CVE-2023-32749
HIGHPydio Cells < 3.0.12 - Unauthenticated Privilege Escalation via External User Role Assignment
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2023-32749. PoCs published by RedTeam Pentesting GmbH, alaeddine03, xcr-19.
AI-analyzed exploit summary This exploit demonstrates unauthorised role assignments in Pydio Cells 4.1.2 and earlier by creating a new user with elevated privileges via a modified HTTP PUT request. It leverages the ability to assign all available roles to a newly created user, enabling privilege escalation.
Description
Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.
Exploits (3)
This exploit demonstrates unauthorised role assignments in Pydio Cells 4.1.2 and earlier by creating a new user with elevated privileges via a modified HTTP PUT request. It leverages the ability to assign all available roles to a newly created user, enabling privilege escalation.
The repository contains a functional Python script that exploits CVE-2023-32749, allowing a low-privileged authenticated user to create a new external user with all roles assigned in Pydio Cells. The exploit leverages improper role assignment validation to escalate privileges.
This PoC exploits CVE-2023-32749 in Pydio Cells to create a new user account with elevated privileges by leveraging a valid credential. It interacts with the REST API to authenticate, retrieve user UUIDs, and create a new user with all available roles.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H