Summary
Metasploit's msf-ws REST API allows an unauthenticated caller to create a user while the users table is empty. Because the bootstrap authentication exemption bypasses the administrator check, the caller may create an administrator account if the API is reachable in that state.
Metasploit's msf-ws REST API allows an unauthenticated caller to create a user while the users table is empty. Because the bootstrap authentication exemption bypasses the administrator check, the caller may create an administrator account if the API is reachable in that state.
Affected context
The issue occurs in the msf-ws REST API's user-creation flow when the users table is empty. In this bootstrap state, the API exempts the user-creation route from authentication, and the exemption can allow an unauthenticated caller to create an administrator account.
The issue occurs in the msf-ws REST API's user-creation flow when the users table is empty. In this bootstrap state, the API exempts the user-creation route from authentication, and the exemption can allow an unauthenticated caller to create an administrator account.
Exploit preconditions
- Attack surface: The msf-ws REST API, specifically
POST /api/v1/users - Required access: No authentication is required while the users table is empty
- Trigger point: A request to create a user during the unauthenticated bootstrap state
- Why exploitation is possible: The inherited authentication method returns success before the administrator-specific authorization check is evaluated
- Attack surface: The msf-ws REST API, specifically
POST /api/v1/users - Required access: No authentication is required while the users table is empty
- Trigger point: A request to create a user during the unauthenticated bootstrap state
- Why exploitation is possible: The inherited authentication method returns success before the administrator-specific authorization check is evaluated
Why this happens
The authentication flow treats an uninitialized application as an unconditional authentication success. This bypasses the administrator check in the API token authentication path and allows a critical user-creation function to be reached without verifying the caller's identity. This maps to CWE-306: Missing Authentication for Critical Function.
The authentication flow treats an uninitialized application as an unconditional authentication success. This bypasses the administrator check in the API token authentication path and allows a critical user-creation function to be reached without verifying the caller's identity. This maps to CWE-306: Missing Authentication for Critical Function.
Potential impact
- An unauthenticated caller could create an account
- The caller could create an administrator account and gain privileged access
- An attacker with administrative access could change application data or settings
- An unauthenticated caller could create an account
- The caller could create an administrator account and gain privileged access
- An attacker with administrative access could change application data or settings
General mitigation guidance
Defensive patterns include requiring explicit authorization for account creation, including during bootstrap, and avoiding authentication exemptions that treat an uninitialized state as proof of identity. Bootstrap workflows can use a separate, protected enrollment mechanism, such as a trusted out-of-band setup process. Limit API exposure and apply least privilege to accounts and services that can manage users.
Defensive patterns include requiring explicit authorization for account creation, including during bootstrap, and avoiding authentication exemptions that treat an uninitialized state as proof of identity. Bootstrap workflows can use a separate, protected enrollment mechanism, such as a trusted out-of-band setup process. Limit API exposure and apply least privilege to accounts and services that can manage users.
How teams detect issues like this
- Review authentication code for early-success paths tied to initialization or empty account stores
- Use static analysis and code review to trace authorization checks on user-creation routes
- Monitor for user-creation requests made before an administrator account exists
- Enforce policies requiring authentication and authorization checks for sensitive API operations
- Review authentication code for early-success paths tied to initialization or empty account stores
- Use static analysis and code review to trace authorization checks on user-creation routes
- Monitor for user-creation requests made before an administrator account exists
- Enforce policies requiring authentication and authorization checks for sensitive API operations
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
