OpenSTAManagerにおいて、modules/utenti/actions.phpを介した認証なしでの権限昇格の脆弱性

The impact of CVE-2026-27012 is severe. An unauthenticated attacker can exploit this vulnerability by directly calling modules/utenti/actions.php to modify the idgruppo field, effectively changing a user's group affiliation. This allows for the promotion of standard users to the highly privileged 'Amministratori' group, granting them full administrative control over the system. Conversely, an attacker could demote existing administrators, disrupting operations and potentially gaining persistent access. This vulnerability essentially grants an attacker the ability to completely compromise the integrity and security of the OpenSTAManager installation.

Organizations utilizing OpenSTAManager for document management and collaboration are at risk, particularly those relying on the 'Amministratori' group for critical administrative tasks. Environments with limited network segmentation or inadequate web application firewalls are especially vulnerable, as direct access to the vulnerable endpoint can be easily exploited.

• php: Examine web server access logs for direct requests to http://<IP>:8080/modules/utenti/actions.php without authentication.

grep -i "modules/utenti/actions.php" /var/log/apache2/access.log

• php: Search for modifications to the idgruppo field in the application's database, particularly for users who were not previously administrators.

SELECT username, idgruppo FROM users WHERE idgruppo = 'Amministratori' AND username NOT IN (SELECT username FROM administrators);

• generic web: Monitor for unusual user activity, such as users suddenly gaining administrative privileges or performing actions they wouldn't normally have access to.

1. 2026-03-03Disclosure

   disclosure

1. 予約済み2026-02-17
2. 公開日2026-03-03
3. 更新日2026-03-04
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-27012 is to upgrade OpenSTAManager to a patched version. Unfortunately, a specific fixed version isn't provided in the input. Until a patch is available, consider implementing temporary workarounds. Restrict direct access to modules/utenti/actions.php using a web application firewall (WAF) or proxy server, blocking any external requests to this endpoint. Review and harden access control lists (ACLs) to limit the impact of potential group modifications. Monitor access logs for suspicious activity, particularly attempts to modify user group assignments.

最終更新

2.10.4最近