CVE-2023-31123
📋 TL;DR
This vulnerability allows any user with a valid password to log in as any other user on affected tripreporter instances. It affects all users of self-hosted tripreporter instances before the patch, but users of subjective.report are not affected.
💻 Affected Systems
- effectindex/tripreporter
📦 What is this software?
Tripreporter by Effectindex
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of all users, unauthorized access to all trip reports and personal data, potential data manipulation or deletion.
Likely Case
Unauthorized users accessing other accounts to view or modify trip reports, potential data leakage of sensitive trip information.
If Mitigated
Limited to authenticated users only, but still allows privilege escalation within the application.
🎯 Exploit Status
Exploitation requires a valid user account but allows logging in as any other user with any valid password.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit bd80ba833b9023d39ca22e29874296c8729dd53b or newer
Vendor Advisory: https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-h6m6
Restart Required: Yes
Instructions:
1. Pull latest code from GitHub repository. 2. Apply commit bd80ba833b9023d39ca22e29874296c8729dd53b. 3. Restart the tripreporter service.
🔧 Temporary Workarounds
Manual patch application
allApply the specific commit that fixes the password verification logic
git cherry-pick bd80ba833b9023d39ca22e29874296c8729dd53b
🧯 If You Can't Patch
- Disable user authentication and make the instance read-only if possible
- Implement network-level access controls to limit who can access the application
🔍 How to Verify
Check if Vulnerable:
Check if your instance is running code from before commit bd80ba833b9023d39ca22e29874296c8729dd53bCheck Version:
git log --oneline -1Verify Fix Applied:
Verify the commit hash includes bd80ba833b9023d39ca22e29874296c8729dd53b or newer📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins from same IP to different accounts
- Unusual account access patterns
- Failed login attempts followed by successful logins to different accounts
Network Indicators:
- Rapid authentication requests to different user accounts from same source
SIEM Query:
source="tripreporter" AND (event="login_success" OR event="authentication") | stats count by src_ip, user | where count > 1🔗 References
- https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e29874296c8729dd53b
- https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-h6m6
- https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e29874296c8729dd53b
- https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-h6m6
