Privilege Escalation in GoatCounter via Mass Assignment

GoatCounter versions through 2.7.0 contain a mass assignment privilege escalation vulnerability located in the userPrefSave handler. This vulnerability arises from improper validation of form-encoded requests submitted to the /user/pref endpoint. Authenticated users with read-only access can exploit this flaw to overwrite protected account fields by including unauthorized keys in their POST requests. Specifically, by injecting parameters such as 'user.access[all]=*' and 'user.email_verified=true', a standard user can circumvent application logic and grant themselves superuser or administrative privileges. This vulnerability is critical for organizations relying on GoatCounter for internal analytics, as it allows unauthorized users to gain full control over the analytics dashboard and account settings.

Impact

Successful exploitation allows a low-privileged authenticated user to gain full administrative control over the GoatCounter instance. This facilitates unauthorized access to potentially sensitive analytics data, modification of site configurations, and management of other user accounts within the environment.

Recommendation

• Upgrade GoatCounter to a version greater than 2.7.0 immediately.
• Implement strict monitoring on the /user/pref endpoint for anomalous POST requests containing unexpected parameter structures, specifically those attempting to set access control fields.
• Audit existing administrative user accounts for unauthorized additions or unexpected changes to account permissions.