EspoCRM Authentication Vulnerability Allowing Privilege Escalation

An authentication vulnerability in EspoCRM version 5.8.5 allows attackers to access other user accounts by manipulating authorization headers. By decoding and modifying Basic Authorization and Espo-Authorization tokens, attackers can gain unauthorized access to administrative user information and privileges.

Impact

Exploitation of this vulnerability leads to unauthorized access to user accounts, allowing attackers to access sensitive information and administrative privileges.

Reproduction

To reproduce this vulnerability, send a request to the '/api/v1/App/user' endpoint with the 'Authorization' and 'Espo-Authorization' headers. After receiving the user details, decode the 'Authorization' and 'Espo-Authorization' values. Modify the 'Espo-Authorization' header to replace the username with another user's name, such as 'admin', and resend the request. This will grant access to the information and privileges of the user whose name was substituted.