Horizon Alert
Summary of the vulnerability and why it matters
RansomLook's web-based configuration editor, accessible through the /admin/config endpoint, contains an authorization weakness. While it requires authentication, it lacks explicit administrator checks, allowing authenticated low-privileged users to modify critical application settings like notifications, LDAP, SMTP, and general configurations, potentially disrupting services or altering security behavior. The editor also handles sensitive data such as passwords and API keys, increasing the risk if an account is compromised.
- Authenticated users can alter critical settings.
- It could disrupt services or compromise sensitive data.
- Confirm relevance and assess potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker with an authenticated, low-privileged account can access a web-based configuration editor. By submitting specially crafted configuration values to the `/admin/config` endpoint, they can directly modify sensitive settings within the `config/generic.json` file. This allows for manipulation of security features, redirection of data, or denial of service.
- Authenticated low-privileged access required.
- Submitting crafted configuration values.
- Altering security-sensitive application behavior.
Live Threat
Current exploitation, exposure, and threat context
An authorization weakness in the web-based configuration editor could allow an authenticated user to submit crafted configuration values. This may affect security-sensitive application behavior, redirect integrations or notifications, modify authentication configurations, disrupt external services, or render the installation unavailable. The configuration file could also contain sensitive values like passwords and API keys.
- Application configuration and sensitive values.
- Authenticated user submits crafted values.
- Application disruption or compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
The critical authorization weakness in RansomLook's web-based configuration editor means that any authenticated user, even with low privileges, could potentially modify sensitive application settings, including security configurations, notifications, and authentication details. This could disrupt services, redirect integrations, or expose sensitive credentials. The first practical step is to identify all instances of RansomLook, determine their reachability and business criticality, and locate the accountable owner to plan remediation.
- Application owners must coordinate remediation efforts.
- Verify all RansomLook instances and their exposure.
- Plan for configuration updates or removal.
