漏洞标题
OpenObserve 用户API中存在Privilege Escalation漏洞
漏洞描述信息
OpenObserve是一个专门为日志、指标、跟踪、分析设计的可观测性平台，旨在处理PB级别的数据。在"/api/{org_id}/users"端点上发现了一个漏洞。这个漏洞允许任何经过身份验证的普通用户（'member'）为组织添加具有提升权限的新用户，包括'root'角色。这规避了角色分配预期的安全控制措施。
漏洞存在于用户创建过程中的payload中，它没有验证用户的角色。一个普通用户可以操纵payload，从而分配顶级权限，如root。
这个漏洞导致未经授权的特权升级，并严重削弱了应用基于角色的访问控制系统。它允许对应用程序资源进行未经授权的控制，并对数据安全构成风险。
所有用户，特别是那些拥有管理角色的用户，都会受到影响。这个问题已在0.8.0版本中得到了解决。建议用户升级以避免漏洞。目前尚无已知的此漏洞的工作绕过方法。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
特权管理不恰当
漏洞标题
OpenObserve Privilege Escalation Vulnerability in Users API
漏洞描述信息
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular user ('member') to add new users with elevated privileges, including the 'root' role, to an organization. This issue circumvents the intended security controls for role assignments. The vulnerability resides in the user creation process, where the payload does not validate the user roles. A regular user can manipulate the payload to assign root-level privileges. This vulnerability leads to Unauthorized Privilege Escalation and significantly compromises the application's role-based access control system. It allows unauthorized control over application resources and poses a risk to data security. All users, particularly those in administrative roles, are impacted. This issue has been addressed in release version 0.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
漏洞类别
特权管理不恰当
漏洞标题
OpenObserve 安全漏洞
漏洞描述信息
OpenObserve是OpenObserve开源的一个云原生可观察性平台。 OpenObserve 0.8.0之前版本存在安全漏洞，该漏洞源于 User Api存在权限提升漏洞。
CVSS信息
N/A
漏洞类别
其他