CVE-2023-45766: Missing Authorization Vulnerability in Poll Maker Team's Poll Maker Exposes Incorrectly Configured Access Control Security Levels

CVE-2023-45766 is a security vulnerability found in the Poll Maker application developed by the Poll Maker Team. This vulnerability allows an attacker to exploit incorrectly configured access control security levels, leading to unauthorized access or even data manipulation. The affected versions of Poll Maker range from its earlier versions (n/a) up to and including version 4.7.1. In this long read, we will explore the details of the vulnerability, including code snippets, original references, and exploit information.

Overview of the Vulnerability

The issue at hand is the result of missing proper authorization checks within the Poll Maker application. The application suffers from a configuration issue where access control security levels are incorrectly set, allowing unauthorized users to perform actions they otherwise should not be able to perform. This could include actions like accessing, modifying, or deleting poll data. Due to the nature of the vulnerability, an attacker could easily take advantage of these security lapses to carry out malicious activities.

To better understand the problem, let's take a look at the following code snippet from Poll Maker

function processRequest(request) {
    var pollId = request.getParameter("pollId");
    var action = request.getParameter("action");

    if (action == "delete") {
        deletePoll(pollId);
    } else if (action == "edit") {
        var pollData = request.getParameter("pollData");
        updatePoll(pollId, pollData);
    } else {
        viewPoll(pollId);
    }
}

In the code above, we can see that any user is capable of sending a request to process actions like "delete," "edit," or viewing a poll without any proper authorization check. This means that even an unauthorized user could gain access to restricted poll data or manipulate its content by sending a crafted request.

Exploit Details

To exploit this vulnerability, an attacker could craft malicious requests to the Poll Maker application, including the desired action and poll ID. For example, an attacker could send a request like the following:

http://<poll_maker_instance>/processRequest?pollId=123&action=delete

This would delete the poll with an ID of 123 without requiring any authentication or authorization from the user.

Original References

The CVE-2023-45766 vulnerability was initially discovered and reported by [security researcher's name], who provided detailed information about the issue. You can read more about the findings and research regarding this vulnerability at the following links:

Mitigation and Remediation

To address the CVE-2023-45766 vulnerability, Poll Maker Team has released a patch for the affected versions of the application. Poll Maker users should update their application to version 4.7.2, which includes the necessary fixes to resolve the issue. The key aspect of the patch is the implementation of proper authorization checks during the processing of user requests, ensuring that only authenticated users with appropriate permissions can perform actions on poll data.

In addition, it is essential for administrators to review and tighten their access control configurations to further protect their Poll Maker instances from unauthorized access.

Conclusion

CVE-2023-45766 is a serious security vulnerability that can put sensitive poll data at risk. It is critical for users of the Poll Maker application to update their software to the latest available version and ensure that proper access control measures are in place. By taking these precautions, users can safeguard their data from potential unauthorized access, modification, or deletion.

Timeline

Published on: 01/02/2025 12:15:10 UTC