TeamPass Improper Privilege Management in nilsteampassnet/teampass
Summary
CVE-2017-15055: TeamPass Improper Privilege Management. Affects nilsteampassnet/teampass versions < 2.1.27.9. Fixed in 2.1.27.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TeamPass is a password management system that allows users to securely store and share passwords. It provides features such as item access control, file attachments, and password history. However, a vulnerability has been discovered in the nilsteampassnet/teampass package before version 2.1.27.9, which allows attackers to bypass item access control and perform various unauthorized actions.
Vulnerability Detail
The vulnerability in TeamPass arises from a lack of proper enforcement of item access control when requesting items.queries.php. This allows an authenticated attacker to tamper with the requests and exploit the following actions:
- Copy any arbitrary item into a directory controlled by the attacker
- Edit any item within a read-only directory
- Delete an arbitrary item
- Delete the file attachments of an arbitrary item
- Copy the password of an arbitrary item to the copy/paste buffer
- Access the history of an arbitrary item
- Edit attributes of an arbitrary directory
To exploit this vulnerability, an attacker needs to modify the "item_id" parameter when invoking the "copy_item" function on items.queries.php.
How To Fix
Minimum fixed version
2.1.27.9
This is the first release that contains the fix.
composer require nilsteampassnet/teampass:2.1.27.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the package to mitigate the risk.
Conclusion
The TeamPass package before version 2.1.27.9 is vulnerable to improper privilege management, allowing authenticated attackers to perform unauthorized actions. It is crucial to upgrade to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
TeamPass is a password management system that allows users to securely store and share passwords.
This vulnerability allows authenticated attackers to bypass item access control and perform various unauthorized actions, such as copying, editing, and deleting items, as well as accessing password history.
To fix this vulnerability, you should upgrade to version 2.1.27.9 or later of the nilsteampassnet/teampass package.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7ghm-6p42-h226/GHSA-7ghm-6p42-h226.json
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
