CVE-2024-46627: Incorrect Access Control in BECN DATAGERRY v2.2

Summary

DATAGERRY v2.2 does not enforce access control on a set of user-settings REST API endpoints. An unauthenticated attacker can read, create, update and delete the settings of any user without valid credentials.

This vulnerability is tracked as CVE-2024-46627. The authoritative record is on the CVE List (CVE-2024-46627), with severity metrics on the National Vulnerability Database.

Affected endpoints

• /rest/users/<id>/settings/ — GET, POST
• /rest/users/<id>/settings/<setting> — DELETE, PUT

The behaviour is reproducible against the vendor's Docker setup as of the disclosure date. In testing it was possible to enumerate all settings objects for a user, retrieve a specific settings object, update an existing object, create a new object, and delete an object — all without authentication. Notably, a create operation returned a 500 error yet still persisted the object, confirmed by re-reading the list.

Impact

The endpoints do not filter the stored values, so beyond unauthorised read and write of any user's settings there is scope to inject script content into stored data. The core issue is broken access control on state-changing API endpoints, which undermines the integrity of user configuration across the application.

Remediation

• Enforce authentication and per-user authorisation on every REST endpoint that reads or modifies user data.
• Return consistent status codes and ensure failed operations do not partially persist.
• Validate and encode stored settings values to prevent script injection.

Common questions