Geex-Arts Django-Jet Dashboard Module Authorization Bypass Vulnerability

An authorization bypass vulnerability has been identified in Geex-Arts Django-Jet versions through 1.0.8, specifically within the Dashboard Module. The issue arises in the file jet/dashboard/views.py, where an unknown function fails to enforce proper authorization checks. This vulnerability allows staff users to access and modify other staff users' dashboard modules by manipulating the module's primary key. Additionally, the Google Analytics and Yandex Metrika credential revoke endpoints can be accessed without authentication or ownership verification. The vulnerability can be exploited remotely, and public exploits are available.

Impact

Exploitation of this vulnerability allows for cross-user access and modification of dashboard modules, unauthorized deletion of OAuth credentials, and improper binding of third-party authorization tokens between users.

Reproduction

The vulnerability can be reproduced by a staff user who accesses another staff user's dashboard module by changing the module's primary key. This can be done through the dashboard module URL, which lacks proper authorization scoping. Additionally, the Google Analytics and Yandex Metrika revoke endpoints can be called without authentication or ownership checks, simply by including the victim's module primary key in the request.

Remediation

To address this vulnerability, it is recommended to scope dashboard module operations to the current user, verify module ownership before any updates or OAuth operations, require authenticated staff access for revoke endpoints, make these endpoints POST-only and CSRF-protected, and use a secure, unpredictable OAuth state nonce.