AiKaan IoT Platform Unauthorized Privilege Escalation Vulnerability in Department Admin Assignment APIs

A vulnerability in the AiKaan IoT Platform's department admin assignment APIs allows authenticated users to escalate privileges by assigning themselves as admins of other departments. This issue arises from a lack of server-side authorization, enabling unauthorized privilege escalation across departments. The vulnerability affects AiKaan IoT Platform versions through v3.25.0325-5-g2e9c59796.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling users to gain admin rights in departments other than their own.

Reproduction

Users can exploit this vulnerability by first obtaining the IDs of other departments through the user interface. Once they have this information, they can manipulate the department admin assignment APIs to assign themselves as admins of those departments, bypassing authorization checks.