Tandoor Recipes Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Tandoor Recipes version 2.0.0-alpha-1, due to an API rework that exposed boolean values in the User Profile API Endpoint. These values indicate whether a user is staff or administrative, allowing any user to elevate their privileges to the highest level. The vulnerability has been addressed in version 2.0.0-alpha-2.

Impact

Exploitation of this vulnerability allows users to gain administrative privileges, including staff and superuser rights.

Reproduction

To reproduce this vulnerability, a user can send an API request to the User Profile Endpoint, including the is_staff and is_superuser parameters. By setting these parameters to true, the user can escalate their privileges to that of an admin.

Remediation

Users can upgrade to Tandoor Recipes version 2.0.0-alpha-2 to address this vulnerability.