Insecure permission: A normal user can escalate his/her role to admin

[HeddaZhu]

Overview

There exists an insecure permission in BRCC from version 1.0.1 to latest. A normal user can escalate his/her role to admin via a POST request.

The affected interface is /console/admin/updateAdmin/{userId}.
This interface allows normal users to arbitrarily modify their own roles.

Details

Affected Function: com.baidu.brcc.controller.AdminController#updateAdmin

The validation logic in the interface implementation:

1. Whether the user is in an available state.
2. Whether the user is an administrator; if not, it only needs to be verified whether they are modifying their own data.

The interface implementation did not validate whether non-administrator users could modify their own roles, thus allowing normal users to change their roles to administrator without any restrictions.

Exploit

test001 is a normal user, the code of role is 0.
rcc-token in the header of request is the token of test001.

It's successful. test001 has become an administrator.