OWASP DefectDojo Authorization Bypass Vulnerability in Benchmark Engagement Product Survey Component

An authorization bypass vulnerability has been identified in OWASP DefectDojo versions through 2.55.4. The issue arises in the Benchmark/Engagement/Product/Survey component, where authorization checks are improperly implemented. The vulnerability allows remote manipulation that bypasses authorization, enabling access to restricted functionalities. This flaw has been publicly disclosed and exploited.

Impact

Exploitation of this vulnerability allows unauthorized access to risk acceptance data, including the ability to view, edit, expire, reinstate, and delete risk acceptances that do not belong to the user.

Reproduction

To reproduce this vulnerability, log in with an account that has access to a specific engagement. Then, send a request to access a risk acceptance from a different engagement that the account does not have access to. The response will incorrectly allow access to the risk acceptance details.

Remediation

Users are advised to upgrade to OWASP DefectDojo version 2.56.0, where this vulnerability has been fixed.