OpenProject Hocuspocus Synchronization Server Authentication Token Decryption Vulnerability

A vulnerability in the Hocuspocus synchronization server of OpenProject versions 17.0.0 and 17.0.1 allows for the decryption of authentication tokens. This issue arises because the synchronization server fails to properly validate backend URLs, enabling an attacker to intercept and decrypt tokens to gain access to OpenProject on behalf of the victim. The vulnerability was introduced in OpenProject 17.0.0 and fixed in 17.0.2.

Impact

Exploitation of this vulnerability allows for unauthorized access to OpenProject documents, enabling an attacker to interact with the application on behalf of the victim.

Remediation

Users can update to OpenProject version 17.0.2, where this vulnerability has been patched. If an immediate update is not possible, the collaboration feature can be disabled in the settings, and the Hocuspocus container should also be disabled.