Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Webhood instances.
2. Attacker probes for the presence of the administrative API endpoint, typically located at /api/admins.
3. Attacker determines if the application is in an uninitialized state (no admin account configured).
4. Attacker sends an unauthorized HTTP POST request to the administrative creation endpoint.
5. The vulnerable Webhood/PocketBase API processes the request without validating an existing session or administrative privileges.
6. The application creates a new administrative account based on the attacker's supplied credentials.
7. Attacker authenticates with the newly created administrative credentials.
8. Attacker gains full administrative access to the platform for data exfiltration or system modification.

Impact

Successful exploitation results in full administrative access to the Webhood application, leading to complete compromise of confidentiality, integrity, and availability. Attackers can leverage this access to steal sensitive data, modify application settings, or perform unauthorized operations within the affected environment.

Recommendation

Prioritized actions for detection and remediation:

• Upgrade all Webhood instances to version 0.9.1 or later immediately.
• If upgrading is not immediately possible, restrict access to the /api/admins administrative endpoint using a reverse proxy or firewall rules.
• Deploy detection rules to monitor for POST requests to the /api/admins endpoint, especially those originating from unexpected IP addresses or occurring in high-frequency patterns.
• Review application logs for the creation of new administrator accounts that do not correlate with authorized deployment or administration activities.