M/Monit Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in M/Monit version 3.7.4, allowing authenticated users to alter user permissions by manipulating the admin parameter. Exploitation involves sending a POST request to the /api/1/admin/users/update endpoint with a crafted payload to grant administrative rights to a standard user account.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling standard users to gain administrative access.

Reproduction

To reproduce this vulnerability, log into the application with a standard user account. Once logged in, send a POST request to the /api/1/admin/users/update endpoint. Include a payload that manipulates the admin parameter to grant administrative privileges to the user account.