St2
Monthly
Improper privilege management in StackStorm st2's API Key Handler allows authenticated remote attackers to manipulate the `api_key_api.user` argument in `st2api/st2api/controllers/v1/auth.py`, enabling unauthorized privilege escalation within the automation platform. All versions through 3.9.0 are affected per the CPE data, and a publicly available proof-of-concept exploit exists (GitHub issue #6380). No vendor patch has been released; the StackStorm project has not responded to the responsible disclosure report.
Improper privilege management in StackStorm st2 up to 3.9.0 allows authenticated low-privilege users to bypass user-scoping restrictions on the action executions API by manipulating the `user` query parameter. The root cause is that `assert_user_is_admin_if_user_query_param_is_provided` in `st2api/st2api/controllers/v1/actionexecutions.py` performs no enforcement when the default NoOp RBAC backend is active - meaning every default StackStorm installation without explicit RBAC configuration is vulnerable. A public proof-of-concept exists via GitHub issue #6379, and the vendor has not yet responded to the disclosure; no patch is available at time of analysis.
Improper privilege management in StackStorm st2's API Key Handler allows authenticated remote attackers to manipulate the `api_key_api.user` argument in `st2api/st2api/controllers/v1/auth.py`, enabling unauthorized privilege escalation within the automation platform. All versions through 3.9.0 are affected per the CPE data, and a publicly available proof-of-concept exploit exists (GitHub issue #6380). No vendor patch has been released; the StackStorm project has not responded to the responsible disclosure report.
Improper privilege management in StackStorm st2 up to 3.9.0 allows authenticated low-privilege users to bypass user-scoping restrictions on the action executions API by manipulating the `user` query parameter. The root cause is that `assert_user_is_admin_if_user_query_param_is_provided` in `st2api/st2api/controllers/v1/actionexecutions.py` performs no enforcement when the default NoOp RBAC backend is active - meaning every default StackStorm installation without explicit RBAC configuration is vulnerable. A public proof-of-concept exists via GitHub issue #6379, and the vendor has not yet responded to the disclosure; no patch is available at time of analysis.