William Bastos

An authorization bypass exists due to a user-controlled key, which allows an authorized attacker to elevate privileges over a network.

An authenticated administrator can be induced to delete administrative Import/Export templates via a Cross-Site Request Forgery (CSRF) attack. This occurs because the `AdminImportExport::TemplateDelete` action fails to validate the `ChallengeToken`, enabling an unauthenticated remote attacker to execute a malicious request using the privileges of an active administrator session.

An administrator can inject arbitrary JavaScript into the content of a Custom Page. This script is stored by the application and executed in the browser of any user who accesses that page, leading to a stored cross-site scripting (XSS) condition.

A path traversal issue in the SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This can lead to the deletion of files accessible to the OTRS application process, provided they have overly permissive ownership or file system permissions. The issue does not bypass operating system file permissions; for versions prior to OTRS 7, the web server process permissions apply, while OTRS 7 and later are limited by the dedicated OTRS user permissions. Additionally, the functionality may attempt to include controlled files in a support bundle, although these bundles are sent to a predefined support address.

The Agent Frontend configuration endpoint can be accessed without authentication, allowing remote users to retrieve internal application configuration intended for authenticated users. The exposed data may include authentication configuration, enabled product features, third-party integration settings, configured frontend routes with their authorization groups, and other implementation details. While this does not expose user credentials or allow configuration modification, it enables attackers to fingerprint the installation and identify security-relevant settings to facilitate further attacks.

Authentication tokens are not immediately invalidated when an agent or customer user account is deactivated or the password is changed. This allows a previously obtained JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—to remain valid until its expiration, which can be approximately 16 hours. An attacker possessing such a token can maintain access to the system with the privileges of the affected account. The impact depends on the token's permissions, ranging from limited customer account access to broader ticket, customer, or administrative functionality for agent tokens.

Several administrative actions fail to sufficiently validate if a request was intentionally initiated by an authenticated user. Specifically, the `DBUpdateLogCleanUp` action can be triggered via a GET request without validating a `ChallengeToken`. This allows an unauthenticated remote attacker to trick an authenticated administrator's browser into executing the cleanup action through a crafted request in a malicious web page, resulting in the deletion of DBUpdate log entries. This reduces the availability of diagnostic and historical data for auditing and troubleshooting. Other administrative endpoints lacking `ChallengeToken` validation can trigger actions like deploying or synchronizing existing configurations, though they do not allow the introduction of new configurations. Additionally, export and read-only endpoints lack this validation, but browser same-origin restrictions prevent the response content from being exposed to the attacker.

Improper neutralization of user-controllable input in ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS), which is a technique where malicious scripts are injected into a trusted website and reflected back to the user. By injecting malicious JavaScript into manipulated request URLs via crafted request parameters associated with ticket actions, attackers can execute arbitrary script code within the context of an authenticated agent session when the crafted link is opened.

The issue allows an attacker to utilize a false URL and redirect to the URL of their choosing, due to an open redirect in the plugin.