Summary

An unrestricted project deletion vulnerability allows attackers with specific roles, such as penetration_tester or auditor to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences.

Details

The vulnerability lies in the system's handling of project deletion. Currently, any user with certain roles (e.g., penetration_tester or auditor) can brute-force the deletion of projects using a POST request. Specifically, by sending repeated requests like POST /delete/project/<id>, an attacker can methodically delete all projects in the system.

Once all projects are deleted, attacker need to reload the web page and the system redirects the attacker to the onboarding page, where they can reconfigure the system and add any user, even with Sys Admin privileges, as well as modify other sensitive settings because the system don't have any project.

...[truncated]...
def onboarding(request):
    context = {}
    error = ''

    # check is any projects exists, then redirect to project list else onboarding
    project = Project.objects.first()

    if project:
        slug = project.slug
        return HttpResponseRedirect(reverse('dashboardIndex', kwargs={'slug': slug}))

    if request.method == "POST":
        project_name = request.POST.get('project_name')
        slug = slugify(project_name)
        create_username = request.POST.get('create_username')
        create_password = request.POST.get('create_password')
        create_user_role = request.POST.get('create_user_role')
        key_openai = request.POST.get('key_openai')
        key_netlas = request.POST.get('key_netlas')
        key_chaos = request.POST.get('key_chaos')
        key_hackerone = request.POST.get('key_hackerone')
        username_hackerone = request.POST.get('username_hackerone')
        bug_bounty_mode = request.POST.get('bug_bounty_mode') == 'on'
...[truncated]...

PoC

https://www.youtube.com/watch?v=PbP4pNhCbyY (Unlisted)

Impact

• Delete all projects in the system.
• Gain access to the onboarding page, where they can reconfigure the system, add new users with elevated privileges (e.g., Sys Admin), and change critical configurations.
• RCE (using install tools function in Tool Arsenal)