Crawlab
Monthly
Broken object-level authorization on Crawlab's password-change endpoint allows any authenticated user to overwrite the credentials of any platform account, including administrators, without ownership or role verification. The attack is a two-step IDOR chain: enumerate user IDs through an unrestricted user-listing endpoint, then submit a password-change request targeting the administrator account ID. Once administrator access is seized, full platform control enables deployment of malicious crawler scripts, achieving arbitrary code execution across all distributed worker nodes. No public exploit has been identified at time of analysis, though the IDOR pattern is trivially reproducible by any holder of a valid session.
Broken object-level authorization on Crawlab's password-change endpoint allows any authenticated user to overwrite the credentials of any platform account, including administrators, without ownership or role verification. The attack is a two-step IDOR chain: enumerate user IDs through an unrestricted user-listing endpoint, then submit a password-change request targeting the administrator account ID. Once administrator access is seized, full platform control enables deployment of malicious crawler scripts, achieving arbitrary code execution across all distributed worker nodes. No public exploit has been identified at time of analysis, though the IDOR pattern is trivially reproducible by any holder of a valid session.