SecBoard
Zurück zur CVE-Übersicht

CVE-2026-53958

HIGH(7.6)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Risk Signal Score19/100 — NIEDRIG
  • CVSS 7.6 — Hoch

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.6

Technische Schwere

Beschreibung

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity attributes from user input. An attacker can place a victim's provider identifier on an attacker-controlled account, causing the default lookup in helpers such as server/api/helpers/users/get-create-one-for-github-sso.js to match the victim's first SSO login to the attacker's account before the email-linkage flow runs. The victim is logged into the attacker-controlled account, and projects, boards, or data the victim creates remain accessible through the attacker's original local credentials. This issue is fixed in version 3.3.9.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 3.3.9

Threat-Hunting-Queries

Die Schwachstelle ist eine Mass Assignment-Schwachstelle, die es einem authentifizierten Benutzer ermöglicht, SSO-Identifikatoren zu ändern. Die Erkennung sollte sich auf ungewöhnliche PATCH-Anfragen an den /api/users/:id-Endpunkt konzentrieren, die SSO-bezogene Felder (ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, ssoOid

Sentinel/Defender KQL

let relevant_sso_fields = dynamic(['ssoGoogleId', 'ssoGoogleEmail', 'ssoGithubId', 'ssoGithubUsername', 'ssoGithubEmail', 'ssoMicrosoftId', 'ssoMicrosoftEmail', 'ssoOidcId', 'ssoOidcEmail']);
SecurityEvent
| where EventID == 4688 // Process Creation (Windows, if applicable)
| where CommandLine contains "PATCH /api/users/"
| extend RequestBody = extractjson("$..", CommandLine, typeof(string)) // Placeholder for extracting request body from logs
| where RequestBody has_any (relevant_sso_fields)
| project TimeGenerated, Computer, Account, CommandLine, RequestBody
| join kind=leftouter (
    SecurityEvent
    | where EventID == 4624 // Successful Logon (Windows, if applicable)
    | project TimeGenerated, Account, IpAddress
) on Account
| summarize count() by Account, IpAddress, bin(TimeGenerated, 1h)
| where count_ > 1 // Look for multiple changes or suspicious activity

Splunk SPL

index=your_webserver_logs sourcetype=your_app_logs "PATCH /api/users/" (ssoGoogleId OR ssoGoogleEmail OR ssoGithubId OR ssoGithubUsername OR ssoGithubEmail OR ssoMicrosoftId OR ssoMicrosoftEmail OR ssoOidcId OR ssoOidcEmail)
| stats count by _time, user, src_ip, uri_path, http_method, request_body
| where count > 1 // Adjust threshold as needed for suspicious activity

Sigma

title: 4gaBoards SSO Mass Assignment Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to exploit the 4gaBoards SSO Mass Assignment vulnerability via PATCH /api/users/:id.
author: SecBoard
date: 2026/06/06
logsource:
  category: webserver
  product: 4gaboards
detection:
  selection:
    http_method: 'PATCH'
    uri_path|contains: '/api/users/'
    request_body|contains:
      - 'ssoGoogleId'
      - 'ssoGoogleEmail'
      - 'ssoGithubId'
      - 'ssoGithubUsername'
      - 'ssoGithubEmail'
      - 'ssoMicrosoftId'
      - 'ssoMicrosoftEmail'
      - 'ssoOidcId'
      - 'ssoOidcEmail'
  condition: selection
level: high

Elastic ES|QL

FROM your_webserver_logs
WHERE http.request.method == 'PATCH'
  AND http.request.url.path LIKE '/api/users/%'
  AND (
    http.request.body.content LIKE '%ssoGoogleId%'
    OR http.request.body.content LIKE '%ssoGoogleEmail%'
    OR http.request.body.content LIKE '%ssoGithubId%'
    OR http.request.body.content LIKE '%ssoGithubUsername%'
    OR http.request.body.content LIKE '%ssoGithubEmail%'
    OR http.request.body.content LIKE '%ssoMicrosoftId%'
    OR http.request.body.content LIKE '%ssoMicrosoftEmail%'
    OR http.request.body.content LIKE '%ssoOidcId%'
    OR http.request.body.content LIKE '%ssoOidcEmail%'
  )
| SELECT @timestamp, http.request.method, http.request.url.path, http.request.body.content, user.name, source.ip

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 7a79f4c5d338614058515752abd67e49ee2818bb

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen