Listen to this Post
OpenWISP IPAM is a multi-tenant IP address management system where every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The vulnerability exists in the CSV export endpoint, ExportSubnetView, which omits the organization-membership check that its import sibling performs.
The `ImportSubnetView.post()` method properly authorizes requests by calling assert_organization_permissions(). This method verifies that the requesting user belongs to the target organization unless they are a superuser. However, `ExportSubnetView.post()` performs no such check. Although the view is declared with `IpAddressOrgMixin` (whose organization scoping lives in get_queryset()), the overridden `post()` method never calls `get_queryset()` or assert_organization_permissions(). Instead, it goes straight to export_csv().
The `export_csv()` function resolves the subnet by primary key with no organization filter and writes its full contents:
subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id) any org's subnet
It then writes the subnet name, CIDR, organization slug, and every IP address (address, description, etc.).
The `subnet_id` is a random UUIDField, so an attacker must obtain the target subnet’s ID rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet IDs routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization ID can leak.
The same single-object pattern (resolving the subnet by `subnet_id` outside the org-scoped queryset) also appears in `AvailableIpView.get()` and `RequestIPView.post()` (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.
DailyCVE Form:
Platform: OpenWISP IPAM
Version: < 1.2.1
Vulnerability: Multi-tenant authorization bypass (missing org check)
Severity: Medium
date: 2026-08-26
Prediction: 2026-06-15 (fixed in v1.2.1)
What Undercode Say:
Analytics of the vulnerability shows the following key observations:
The export endpoint `ExportSubnetView` lacks the organization-membership check present in ImportSubnetView. The fix is trivial — a one-line authorization call. The vulnerability was verified by hand in the current master branch. The `subnet_id` is a UUID, making enumeration difficult but not impossible as IDs can leak through various channels. The same pattern appears in other views (AvailableIpView, RequestIPView) which should be reviewed alongside the export fix.
Exploit: (Educational Purposes!)
Prerequisites: An OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose ID `S` is known to the attacker.
1. Authenticate to the API as the OrgB user
(Obtain authentication token via login endpoint)
2. Issue a POST request to the export endpoint with OrgA's subnet ID
curl -X POST https://openwisp.example.com/api/v1/subnet/{S}/export/ \
-H "Authorization: Token <orgb_user_token>" \
-H "Content-Type: application/json"
3. The response returns a CSV download containing:
- OrgA's subnet name
- OrgA's CIDR
- OrgA's organization slug
- Every IP address in OrgA's subnet with descriptions
Control (proves it’s an oversight): The corresponding import endpoint `POST /api/v1/import-subnet/` with OrgA data is rejected for the same user by assert_organization_permissions().
Protection:
Upgrade to OpenWISP IPAM version 1.2.1 or later, which fixes the admin subnet export multitenancy security issue. If upgrading is not immediately possible, apply the following remediation:
Add the organization-membership check to `ExportSubnetView.post()` — call `self.assert_organization_permissions(request)` (as `ImportSubnetView` does), or resolve the subnet through the org-scoped `get_queryset()` / `get_object()` and return 404 when it isn’t in the caller’s organizations. Apply the same to `AvailableIpView` and RequestIPView.
Impact:
A member of one organization can read the complete contents of another organization’s subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant’s network topology and host inventory. Exploitation requires obtaining the target subnet’s UUID (AC:H), but the authorization check is missing outright. `RequestIPView` shares the pattern and additionally allows writing an IP into another organization’s subnet — a separate integrity concern.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
