CVE-2024-55073
📋 TL;DR
A Broken Object Level Authorization vulnerability in Mealie v2.2.0 allows authenticated users to modify their own profile to escalate privileges or change household assignments. This affects all Mealie instances running the vulnerable version where users have access to their profile endpoint.
💻 Affected Systems
- hay-kot mealie
📦 What is this software?
Mealie by Mealie
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative privileges, potentially compromising all recipe data, user accounts, and system configuration.
Likely Case
Users escalate their privileges to gain unauthorized access to other users' recipes or administrative functions.
If Mitigated
Proper authorization checks prevent unauthorized privilege escalation, limiting users to their intended permissions.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the API endpoint. The vulnerability is documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.2.1 or later
Vendor Advisory: https://github.com/mealie-recipes/mealie/issues/4593
Restart Required: No
Instructions:
1. Update Mealie to version 2.2.1 or later. 2. Verify the update completed successfully. 3. Test that users can no longer modify permissions via the profile endpoint.
🔧 Temporary Workarounds
Disable user profile modifications
allTemporarily restrict access to the /api/users/{user-id} endpoint to prevent exploitation.
Configure web server (nginx/apache) to block PUT/PATCH requests to /api/users/*
🧯 If You Can't Patch
- Implement network segmentation to isolate Mealie instance from sensitive systems
- Enable detailed logging of all user profile modification attempts for monitoring
🔍 How to Verify
Check if Vulnerable:
Check if running Mealie version 2.2.0. Attempt to modify user permissions via the /api/users/{user-id} endpoint as a non-admin user.Check Version:
Check Mealie web interface settings or container image tagVerify Fix Applied:
After updating, verify the version is 2.2.1+. Attempt the same privilege escalation and confirm it fails.📡 Detection & Monitoring
Log Indicators:
- Unusual PUT/PATCH requests to /api/users/ endpoints
- User permission changes from non-admin accounts
Network Indicators:
- HTTP 200 responses to user permission modification requests from non-admin users
SIEM Query:
source="mealie" AND (uri_path="/api/users/*" AND http_method IN ("PUT", "PATCH")) AND user_role!="admin"