Improper Privilege Management in Frappe Framework

Frappe Framework versions prior to 14.81.4 and 15.x prior to 15.41.0 contain a critical vulnerability related to improper privilege management. This flaw allows an authenticated attacker holding the low-privileged 'Website User' role to escalate their account permissions to the 'System Manager' level. The exploitation involves the manipulation of a specific document action within the application. By successfully executing this escalation, an attacker gains administrative control over the Frappe instance, enabling unauthorized access to application data, configuration settings, and potential further system exploitation. Because Frappe is a common back-end framework for ERPNext and other business applications, successful exploitation carries significant risk to organizational integrity and data confidentiality.

Impact

Successful exploitation grants an attacker full System Manager privileges within the Frappe application. This provides administrative access to all documents, system configurations, and internal business logic managed by the platform. This vulnerability affects any organization utilizing self-hosted or cloud-deployed versions of Frappe Framework 14.x or 15.x within the specified version ranges. Unauthorized access of this magnitude can lead to complete data exfiltration, service manipulation, and long-term persistence within the business environment.

Recommendation

1. Upgrade all instances of Frappe Framework to version 14.81.4 or 15.41.0 immediately to address CVE-2024-58390.
2. Review user access logs for any 'Website User' accounts that have recently modified sensitive system documents or accessed System Manager configuration endpoints.
3. Implement principle of least privilege by auditing all current 'System Manager' accounts and ensuring only authorized administrative personnel retain such access.