Postizに認証トークン偽造の欠陥、2.25.3で修正
Summary
SNS投稿管理ツールPostizに、登録済みの一般ユーザーが他のユーザーや組織を乗っ取れる欠陥が見つかりました。2.15.0以上2.25.3未満の版が対象で、2.25.3で修正されています。自社で運用している場合は、版の確認と更新を急いでください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
SNS投稿管理ツールPostizに、登録済みの一般ユーザーが他のユーザーや組織を乗っ取れる欠陥が見つかりました。2.15.0以上2.25.3未満の版が対象で、2.25.3で修正されています。自社で運用している場合は、版の確認と更新を急いでください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| GitroomHQ | postiz-app |
≥ 2.15.0, < 2.25.3 |
2.25.3 |
Original description The description as published by the source.
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.
A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory gadvisory.org
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com