CVE-2024-31218 Authentication Bypass in Webhood

CVE-2024-31218 is a critical authentication vulnerability affecting Webhood versions 0.9.0 and earlier. The flaw exists within the application's integration with the PocketBase administrative API. When the application has not been initialized with an administrator account, the administrative API does not enforce authentication, allowing unauthenticated remote attackers to create a new administrator account. By successfully creating an account, an attacker gains full administrative control over the application. This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 3.1 score of 9.8. Defenders should prioritize upgrading to Webhood 0.9.1 or later.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Webhood instances.
2. Attacker probes for the presence of the administrative API endpoint, typically located at /api/admins.
3. Attacker determines if the application is in an uninitialized state (no admin account configured).
4. Attacker sends an unauthorized HTTP POST request to the administrative creation endpoint.
5. The vulnerable Webhood/PocketBase API processes the request without validating an existing session or administrative privileges.
6. The application creates a new administrative account based on the attacker's supplied credentials.
7. Attacker authenticates with the newly created administrative credentials.
8. Attacker gains full administrative access to the platform for data exfiltration or system modification.

Impact

Successful exploitation results in full administrative access to the Webhood application, leading to complete compromise of confidentiality, integrity, and availability. Attackers can leverage this access to steal sensitive data, modify application settings, or perform unauthorized operations within the affected environment.

Recommendation

Prioritized actions for detection and remediation:

• Upgrade all Webhood instances to version 0.9.1 or later immediately.
• If upgrading is not immediately possible, restrict access to the /api/admins administrative endpoint using a reverse proxy or firewall rules.
• Deploy detection rules to monitor for POST requests to the /api/admins endpoint, especially those originating from unexpected IP addresses or occurring in high-frequency patterns.
• Review application logs for the creation of new administrator accounts that do not correlate with authorized deployment or administration activities.