OSM MANO Vulnerability Analysis: CVE-2024-48729 BOLA and Privilege Escalation

Critical Vulnerability Information 1. CVE-2024-48729: Broken Object Level Authorization Description: In OSM MANO, attackers can bypass object-level authorization checks by modifying the and fields, thereby accessing or modifying resources belonging to other users. Impact: Attackers can gain access to other users' projects by replacing these fields, leading to data leakage or tampering. 2. Account Take-over through Credential Replacement Description: Attackers can take over accounts by changing the admin password and exploiting known default credentials (such as ). Impact: Once an account is compromised, attackers gain full control over the system. 3. Privilege Escalation by Role Self-Assignment Description: Attackers can escalate their privileges by assigning themselves roles with higher permissions (e.g., the role). Impact: This enables attackers to perform actions typically restricted to administrators, expanding the attack surface. 4. Denial of Service by Role Assignment Description: Attackers can exhaust system resources by creating a large number of projects and assigning roles, leading to service unavailability. Impact: The excessive creation of projects and role assignments consumes significant memory and CPU resources, potentially causing system crashes. 5. CVE-2024-49730: Improper Restriction of Excessive Authentication Attempts Description: The system does not properly restrict the number of authentication attempts, allowing attackers to perform brute-force attacks. Impact: Attackers can repeatedly try different username and password combinations to guess valid credentials, gaining unauthorized access.

Goal Reached Thanks to every supporter — we hit 100%!

OSM MANO Vulnerability Analysis: CVE-2024-48729 BOLA and Privilege Escalation