Pachno Authentication Bypass Vulnerability in Privilege Escalation

An authentication bypass vulnerability has been identified in Pachno version 1.0.6, specifically within the runSwitchUser() action. This vulnerability allows authenticated low-privilege users to manipulate the original_username cookie and escalate privileges by switching to user ID 1. Exploiting this flaw enables access to session tokens or password hashes of administrator accounts.

Impact

Exploitation of this vulnerability allows for remote vertical privilege escalation, enabling low-privilege users to gain administrative rights and access sensitive information such as session tokens or password hashes of admin accounts.

Reproduction

To reproduce this vulnerability, an authenticated low-privilege user must set the original_username cookie to any desired value. Once the cookie is set, the user can request a switch to user ID 1 through the runSwitchUser() action. This will result in the user receiving a session token or password hash belonging to an administrator.