Vulnerability in hcengineering Huly Platform

[ Description ]Official description

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/hcengineering/platform/blob/v0.7.432/server/account/src/operations.ts
• github.com/hcengineering/platform/commit/afe11faec1b56f278c0882355a69b08cff1eebd9
• github.com/hcengineering/platform/issues/10914
• hackmd.io/@hieuPenguinnn/huly-platform-merge-specified-persons-missing-authorization
• www.vulncheck.com/advisories/huly-platform-through-0.7.432-account-takeover-via-mergesp…