PT-2026-86431 · Pypi · Openwisp-Ipam

Published

2026-08-26

·

Updated

2026-08-26

CVSS v3.1

5.3

Medium

VectorAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert organization permissions():
python
# openwisp ipam/api/views.py (ImportSubnetView)
def post(self, request, *args, **kwargs):
  self.assert organization permissions(request)    # <-- org-membership check
  file = request.FILES["csvfile"]
  ...
  self.subnet model().import csv(file)
python
# openwisp ipam/api/utils.py:16 (AuthorizeCSVImport)
def assert organization permissions(self, request):
  if request.user.is superuser:
    return
  # ... otherwise verifies the user belongs to the target organization
ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get queryset()), but its overridden post() never calls get queryset() or assert organization permissions() — it goes straight to export csv():
python
# openwisp ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
  subnet model = Subnet
  def post(self, request, *args, **kwargs):
    response = HttpResponse(content type="text/csv")
    response["Content-Disposition"] = 'attachment; filename="ip address.csv"'
    writer = csv.writer(response)
    self.subnet model().export csv(kwargs["subnet id"], writer)  # no org check reached
    return response
export csv() resolves the subnet by primary key with no organization filter and writes its full contents:
python
# openwisp ipam/base/models.py:242
def export csv(self, subnet id, writer):
  ipaddress model = load model("openwisp ipam", "IpAddress")
  subnet = load model("openwisp ipam", "Subnet").objects.get(pk=subnet id)  # any org's subnet
  # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)
The subnet id is a random UUIDField (migrations/0001 initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.
The same single-object pattern (resolving the subnet by subnet id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).
  1. As the OrgB user, authenticate to the API.
  2. POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
  3. Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
  4. Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert organization permissions().
(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert organization permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get queryset() / get object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

GHSA-X287-5C68-36WP

Affected Products

Openwisp-Ipam