Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in the way Snipe-IT handles Google Single Sign-On (SSO) could allow unauthorized access to the system. If an organization uses Google SSO for Snipe-IT and has users who were previously deactivated but whose usernames resemble a Google account email, they might be able to log in again through Google SSO with their original permissions, potentially including administrator access. The main concern is confirming if your organization uses Snipe-IT with Google SSO and if any deactivated users fit this specific profile.
- Bypasses authentication for specific users.
- Potential for unauthorized access to IT assets.
- Confirm Snipe-IT Google SSO and deactivated user relevance.
Attack Path
How an attacker could exploit the issue
An attacker could leverage this vulnerability by first gaining the ability to initiate the Google Single Sign-On (SSO) process. This would allow them to bypass the standard login and directly access an account if their username matches the email address used for Google authentication, potentially leading to elevated privileges.
- Attack starts with unauthorized login initiation.
- Vulnerable component is Google SSO callback.
- Risk is unauthorized access and privilege escalation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow deactivated users to regain access to the Snipe-IT application, potentially including administrative privileges, by leveraging their Google account credentials. This occurs when the application is configured to use Google Single Sign-On and a user account within Snipe-IT shares the same username as a Google account, even if the Snipe-IT account is deactivated.
- User accounts and their associated permissions.
- Via a bypassed authentication check during Google SSO.
- Unauthorized access and data exposure.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Snipe-IT's Google authentication could allow deactivated users to regain access. The first step is to identify all instances of Snipe-IT, determine their internet reachability and business criticality, and locate the accountable owner. Remediation planning should then proceed based on the identified risk.
- Identify application owners and infrastructure teams.
- Verify Google SSO configuration and user status.
- Plan and execute remediation during maintenance.
