cobbr / cobbr/Covenant

[Bug] User priv escalation

Open
#351 0 comments 0 reactions 1 assignee Claimed by @cobbr View on GitHub
Dominant language
C#
Stars
4.7k
Forks
822
PR merge metrics
No merged PRs in 30d

Description

**Feature Request or Bug**
Bug

**Describe the feature request or bug**
It seems a normal user can alter their privileges and upgrade to Administrator themselves.

**To Reproduce**
Steps to reproduce the behavior:
1. Log in as a user
2. Select Users on the left.
3. Click on your user.
4. Select the drop down for edit roles
5. Click Administrator and wait for a checkmark
6. Click on the screen anywhere to dismiss the dropdown
7. Click edit roles
8. Your user will be an administrator and show when you get back to list all users.

**Expected behavior**
A user should not be able to give themselves administrator roles

**Screenshots**
I do not think this needs a screen shot since it is pretty straight forward and not a specific error being displayed during operation.

**Covenant Server Information:**
- OS: Ubuntu 20.04.3
- Docker or Native: Native

**Browser Information:**
- Browser Chrome
- Version Version 97.0.4692.99 (Official Build) (64-bit)

**Target Information (System that implant is running on):**
Not Applicable

**Additional context**
No additional context

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.