Summary
REDAXO's backup addon does not adequately authorize database export requests, allowing certain non-admin users with the backup[export] permission to export tables beyond those intended for their role. Exposed data may include session identifiers, stay-logged-in keys, and password hashes, which could enable administrator account takeover or offline password cracking.
REDAXO's backup addon does not adequately authorize database export requests, allowing certain non-admin users with the backup[export] permission to export tables beyond those intended for their role. Exposed data may include session identifiers, stay-logged-in keys, and password hashes, which could enable administrator account takeover or offline password cracking.
Affected context
The issue occurs in REDAXO deployments using the affected backup addon export functionality when a non-administrator account has the backup[export] permission. Risk depends on how permissions are assigned and whether application, user, and session tables are accessible through the export workflow.
The issue occurs in REDAXO deployments using the affected backup addon export functionality when a non-administrator account has the backup[export] permission. Risk depends on how permissions are assigned and whether application, user, and session tables are accessible through the export workflow.
Exploit preconditions
- Attack surface: REDAXO backup addon export functionality
- Required access: An authenticated account with the
backup[export]permission - Trigger point: A database export request that identifies a table for export
- Why exploitation is possible: The export operation does not sufficiently verify
that the requesting user is authorized to access the selected table
- Attack surface: REDAXO backup addon export functionality
- Required access: An authenticated account with the
backup[export]permission - Trigger point: A database export request that identifies a table for export
- Why exploitation is possible: The export operation does not sufficiently verify
that the requesting user is authorized to access the selected table
Why this happens
The vulnerability is caused by an authorization failure in a privileged data export function. The application checks whether a user may access the export feature but does not enforce an adequate authorization boundary for every database table that can be requested. This maps to CWE-862, Missing Authorization, where access to a protected resource or operation is not properly validated for the requesting principal.
The vulnerability is caused by an authorization failure in a privileged data export function. The application checks whether a user may access the export feature but does not enforce an adequate authorization boundary for every database table that can be requested. This maps to CWE-862, Missing Authorization, where access to a protected resource or operation is not properly validated for the requesting principal.
Potential impact
- Attackers may export sensitive user and application data.
- Exposed session identifiers or stay-logged-in keys could enable administrator account takeover.
- Password hashes could be obtained for offline cracking attempts.
- Compromised accounts could provide access to administrative functionality.
- Disclosure could affect other applications sharing the same database.
- Attackers may export sensitive user and application data.
- Exposed session identifiers or stay-logged-in keys could enable administrator account takeover.
- Password hashes could be obtained for offline cracking attempts.
- Compromised accounts could provide access to administrative functionality.
- Disclosure could affect other applications sharing the same database.
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the resource and
operation level rather than relying only on access to the export feature.
Common defensive patterns include:
- Allowing exports only for explicitly approved tables and roles.
- Applying server-side authorization checks to every requested table.
- Using deny-by-default policies for user, session, credential, and other sensitive tables.
- Limiting assignment of backup export permissions according to least privilege.
- Avoiding inclusion of session secrets and authentication material in routine exports.
- Protecting exported files with strict storage, access, retention, and encryption controls.
- Invalidating exposed sessions and rotating affected authentication secrets when disclosure is suspected.
Mitigation generally focuses on enforcing authorization at the resource and
operation level rather than relying only on access to the export feature.
Common defensive patterns include:
- Allowing exports only for explicitly approved tables and roles.
- Applying server-side authorization checks to every requested table.
- Using deny-by-default policies for user, session, credential, and other sensitive tables.
- Limiting assignment of backup export permissions according to least privilege.
- Avoiding inclusion of session secrets and authentication material in routine exports.
- Protecting exported files with strict storage, access, retention, and encryption controls.
- Invalidating exposed sessions and rotating affected authentication secrets when disclosure is suspected.
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis and code review checks confirming authorization before each data export.
- Review of export handlers that accept table names or resource identifiers from requests.
- Tests verifying that non-administrative roles cannot export protected tables.
- Monitoring export events for unusual access to user, session, credential, or unrelated application tables.
- Policy enforcement that restricts backup permissions and requires explicit approval for sensitive data exports.
- Automated security testing tools that exercise authorization boundaries across roles and resources.
Organizations can look for this issue through:
- Static analysis and code review checks confirming authorization before each data export.
- Review of export handlers that accept table names or resource identifiers from requests.
- Tests verifying that non-administrative roles cannot export protected tables.
- Monitoring export events for unusual access to user, session, credential, or unrelated application tables.
- Policy enforcement that restricts backup permissions and requires explicit approval for sensitive data exports.
- Automated security testing tools that exercise authorization boundaries across roles and resources.
