Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator a
Leantime has HTML injection through firstname and lastname fields
### Summary
Leantime v2.3.27 is vulnerable to Stored HTML Injection. The `firstname` and `lastname` fields in the admin user edit page are rendered without HTML escaping, allowing an authenticated user to inject arbitrary HTML that executes when the profile is viewed.
### Vulnerable File
`app/Domain/Users/Templates/editUser.tpl.php`
### Vulnerable Code (Lines ~14-17)
```php
value="<?php echo $values['firstname'] ?>"
value="<?php echo $values['lastname'] ?>"
```
These fields output raw user input without sanitization.
### Steps to Reproduce
1. Login as admin > Go to Settings > Users > Edit any user
2. Enter HTML payload in First Name or La
Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions().
Leantime has Missing Authorization Check for Host Parameter
### Finding Description
Application has functionality for a user to view profile information. It does not have an implemented authorization check for "Host" parameter which allows a user to view profile information of another user by replacing "Host" parameter.
### Impact
By exploiting this vulnerability an attacker can able to view profile information (but not anything else or change anything)
### Description
Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key.
### Impact
Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.
**CSRF**
### Summary
A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing.
### Impact
While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
### Summary
A cross-site scripting (XSS) vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not include any validation or sanitization of the $_GET["id"] parameter. As a result, it directly incorporates the user-supplied value into the source path without any checks.
### Summary
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.
### Details
A Stored Cross-Site Scripting (XSS) vulnerability was found that could potentially compromise user data and pose a significant security risk to the platform.
### PoC
- Create a project
- Navigate to project
- Visit to the integration
- Add malicious payload inside the webhook and save it.
- Notice the alert dialogue indicating successful execution of the XSS payload.
```
'';!--" onfocus=alert(0) autofocus="" onload=alert(3);="&{(alert(1))}" |="" mu
### Summary
The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation and output encoding in the file upload process can prevent this exploit. Accessing and enhancing the relevant source code modules is crucial for addressing this security flaw effectively.
### Impact
This XSS vulnerability allows attackers to inject malicious scripts into the Leantime application, compromising user data, session tokens, and poten
Due to improper cache control an attacker can view sensitive information even if they are not logged into the account anymore.
Additional Information:
1.The issue was identified during routine security testing.
2.This vulnerability poses a significant risk to user privacy and data security.
3.Urgent action is recommended to mitigate this vulnerability and protect user data from unauthorized access.
### Summary
A host header injection vulnerability has been identified in the user details viewing functionality of the system. This vulnerability allows an attacker to manipulate the host header in HTTP requests, thereby gaining unauthorized access to view details of other users.