Chatwoot Improper Authorization Vulnerability in Signup Endpoint

A critical improper authorization vulnerability has been identified in Chatwoot versions through 4.11.1. The issue resides in the Signup Endpoint, specifically within the file /app/login. The vulnerability allows unauthorized users to register accounts by manipulating the signupEnabled argument. When this argument is changed to true, the application incorrectly permits registration, even if the signup feature is supposed to be disabled. This exploitation can be done remotely without any authentication.

Impact

Exploitation of this vulnerability allows unauthorized users to bypass signup restrictions and register accounts, including administrative ones, on the affected Chatwoot instance.

Reproduction

To reproduce this vulnerability, intercept a request to the /app/login endpoint using a proxy tool like Burp Suite. Modify the signupEnabled value in the server response from false to true. Once this change is made, the application will accept the manipulated value, allowing unauthorized registration of accounts.