Guohongze Adminset Delivery Deployment Endpoint Authorization Bypass Vulnerability

An authorization bypass vulnerability has been identified in the Guohongze Adminset application, specifically in versions up to 0.61. The issue resides in the delivery deployment endpoint, where the 'project_id' argument is manipulated, allowing users to initiate deployments for projects they do not have permission to access. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows low-privileged users to bypass project-level authorization, enabling unauthorized deployments that could disrupt services or incorrectly roll out code.

Reproduction

To reproduce this vulnerability, create a user with limited permissions assigned to a specific project. This user can then access the delivery deployment URL and, by supplying the 'project_id' of a different project, initiate a deployment for that project without authorization.

Remediation

It is recommended to implement checks that verify a user's permission for a specific project before allowing deployments, ensuring that the same project membership constraints used in the delivery list are applied.