CVE-2023-32749

This exploit demonstrates unauthorised role assignments in Pydio Cells 4.1.2 and earlier by creating a new user with elevated privileges via a modified HTTP PUT request. It leverages the ability to assign all available roles to a newly created user, enabling privilege escalation.

The repository contains a functional Python script that exploits CVE-2023-32749, allowing a low-privileged authenticated user to create a new external user with all roles assigned in Pydio Cells. The exploit leverages improper role assignment validation to escalate privileges.

This PoC exploits CVE-2023-32749 in Pydio Cells to create a new user account with elevated privileges by leveraging a valid credential. It interacts with the REST API to authenticate, retrieve user UUIDs, and create a new user with all available roles.