Penetration test report

Allow org admins to impersonate users

Commit
7d02e9a · feat/impersonate
Pipeline
GitHub Actions #2181
Target
staging.acme.dev
Profile
web-app+api
Duration
7m 05s

Failed policy: block on high or above

Merging feat/impersonate is blocked until the findings are fixed or accepted.

Critical

0

First run on this branch

High

1

First run on this branch

Medium

2

First run on this branch

Low

3

First run on this branch

Fixed in this run

0

Retested and confirmed

Checks run

409

First run on this branch

Findings

POST /api/v2/impersonate accepts any user ID. An admin of one organization received a session for a member of a different organization.

Request

POST /api/v2/impersonate
Host: staging.acme.dev
Authorization: Bearer ‹admin, org 1›

{"userId":"usr_org2_member"}

Response

HTTP/1.1 200 OK
{"session":"…","org":"org_2"}

How to fix

Check that the target user belongs to the caller's organization before issuing the session, and log every impersonation.