Listen to this Post
How the mentioned CVE works:
The vulnerability exists in the `/config/gym-config/edit` endpoint implemented by GymConfigUpdateView. The view declares `permission_required = ‘config.change_gymconfig’` but inherits `WgerFormMixin` instead of WgerPermissionMixin. `WgerFormMixin` only performs ownership checks via get_owner_object(), and the singleton `GymConfig(pk=1)` model lacks this method, causing the mixin to skip all access restrictions. Consequently, any authenticated low-privileged user can submit a POST request to modify the `default_gym` field. The `save()` method then triggers installation-wide side effects: it updates all `UserProfile` records with `gym=NULL` to the chosen gym and creates `GymUserConfig` entries for users without one. This allows an attacker to reassign tenant membership for all gym-less users, including administrators, violating administrative trust boundaries. The application redirects to a permission-protected page after the update, which may show “Forbidden” to the attacker, but the configuration change already persists in the database. Proof of concept: a regular user changes `default_gym` from `None` to 1, causing `profiles_gym_null` to drop from 1 to 0.
dailycve form:
Platform: wger
Version: before patch
Vulnerability: Vertical privilege escalation
Severity: Critical
date: 2024-09-30
Prediction: Patch released 2024-10-01
What Undercode Say:
Check if endpoint is accessible with low-privileged session curl -X GET http://127.0.0.1:8088/en/config/gym-config/edit -H "Cookie: sessionid=lowpriv" Exploit POST request to change default_gym to ID 1 curl -X POST http://127.0.0.1:8088/en/config/gym-config/edit \ -H "Cookie: sessionid=lowpriv" \ -d "default_gym=1" Verify database change (postgres example) docker exec -it wger_db psql -U wger -c "SELECT default_gym_id FROM config_gymconfig WHERE id=1;"
Exploit:
- Authenticate as any low-privileged user (e.g., regular member).
2. Send POST to `/config/gym-config/edit` with `default_gym=`.
- Observe HTTP 302 redirect, then 403 on the redirect target, but configuration is altered.
- After exploit, all users with `gym=NULL` are bulk-updated to the attacker-chosen gym.
Protection from this CVE:
- Apply patch: add `WgerPermissionMixin` before `WgerFormMixin` in
GymConfigUpdateView. - Or use Django’s `PermissionRequiredMixin` with
login_required=True. - Upgrade to wger version that includes fix for GHSA-xppv-4jrx-qf8m.
- Manually enforce permission check by overriding
dispatch().
Impact:
Unauthorized modification of installation-wide default gym, bulk reassignment of all gym-less user profiles to a malicious gym, creation of unauthorized `GymUserConfig` entries, disruption of multi-tenant gym assignments, and potential privilege escalation enabling further administrative actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
