Who is this article for?
Incydr Professional, Enterprise, Gov F2, and Horizon, yes.
Incydr Basic, Advanced, and Gov F1, yes.
CrashPlan Cloud, yes.
Retired product plans, yes.
CrashPlan for Small Business, no.
This article provides details about a security vulnerability where an administrator can impersonate users with a greater set of permissions than themselves in order to perform a web restore.
To protect the security of our customers, we don't publish a security advisory until a vulnerability has been fully investigated and a patch or update is available that resolves the issue.
If you have questions or concerns, contact our Customer Champions for support.
An administrator without web restore permission but with the ability to manage users in an organization can impersonate a user with web restore permission.
When requesting the token to do a web restore, an administrator with permission to manage a user could request the token of that user. If the administrator was not authorized to perform web restores but the user was authorized to perform web restores, this would allow the administrator to impersonate the user with greater permissions. In order to exploit this vulnerability, the user would have to be an administrator with access to manage an organization with a user with greater permissions than themselves.
Code42 Enterprise 6.8.4 or earlier
This vulnerability has been fixed in Code42 app version 6.8.5 and later. To remediate this vulnerability, upgrade the Code42 apps in your environment.
If you are unable to upgrade at this time, a workaround is to segregate higher privileged administrators in separate organizations. Contact our Code42 Customer Champions for more information.
|Date published||July 11, 2019|
|Number of vulnerabilities||1|
|Products||Code42 for Enterprise|
|Affected product versions||Code42 for Enterprise 6.8.4 and earlier|
|Vulnerability type||Incorrect Access Control|
|Impact||Escalation of privileges|
|Affected components||Code42 for Enterprise authority service|
|Attack vectors||An administrator can impersonate users with a greater set of permissions than themselves in order to perform a web restore|
|Description of the vulnerability||
An administrator can impersonate users with a greater set of permissions than themselves in order to perform a web restore.
When you request the token to do a web restore, you can request that token as a different user if you were an admin that could manage the user you were impersonating, which left it possible for you to impersonate a user with greater permissions than the admin who requested the token.
In order for this to be available, the user would have to be an administrator with access to manage an organization with a user with greater permissions than themselves.
|Additional information||Credit for discovery goes to: Ryan Winkelmaier of NCC Group|