Broken Access Control on **healthwatch.trellix.com** Leading to Unauthorized Access and Sensitive Data Exposure

How it was found

Summary

I discovered a critical broken access control vulnerability that allows an attacker to bypass account validation and gain unauthorized access to the application. Once authenticated, the attacker can enumerate all business customers and internal employee email addresses through an unprotected API endpoint, leading to significant information disclosure that could facilitate targeted phishing attacks.

Vulnerability Details

1. Account Registration Bypass

Endpoint: Account registration form

Issue: The application implements insufficient email domain validation during account creation.

Steps to Reproduce:

1. Navigate to the registration page
2. Fill in the registration form with an email address containing the company's domain suffix (e.g., [email protected])
3. Intercept the registration request using Burp Suite
4. Modify the email address in the request to use an arbitrary domain (e.g., [email protected])
5. Forward the modified request
6. Registration succeeds and the account is created pending admin approval

Impact: An attacker can register accounts with external email addresses, bypassing domain validation controls.

2. Account Validation Bypass

Endpoint: Password reset functionality

Issue: The password reset mechanism can be abused to activate accounts that are pending admin approval.

Steps to Reproduce:

1. After creating the account as described above (without setting a password)
2. Navigate to the "Forgot Password" page
3. Submit a password reset request for the registered email address
4. Receive the password reset email at the external email address
5. Complete the password reset process
6. Successfully authenticate to the application dashboard without admin approval

Impact: Attackers can bypass the intended admin approval workflow and gain immediate access to the application.

3. Improper Access Control - Customer Data Enumeration

Endpoint: /api/ApiV1/GetCustomerDetailByEmail

Issue: The API endpoint lacks proper authorization controls, allowing low-privileged users to enumerate all customer business names and associated employee email addresses.

Steps to Reproduce:

1. Authenticate using the compromised account created in steps 1-2
2. Send requests to /api/ApiV1/GetCustomerDetailByEmail
3. Successfully retrieve a complete list of:
   • All customer business names
   • Internal employee email addresses of account creators
   • Customer relationship metadata

Verification: I performed OSINT verification via LinkedIn and confirmed that the exposed email addresses belong to legitimate company employees.

Recommendations

Immediate Actions

1. Disable the vulnerable API endpoint /api/ApiV1/GetCustomerDetailByEmail until proper access controls are implemented
2. Audit all pending accounts and remove unauthorized registrations
3. Implement server-side email domain validation that cannot be bypassed via request manipulation

Long-term Fixes

1. Strengthen Registration Controls

• Implement server-side domain validation with whitelist verification
• Add email verification before account activation
• Maintain admin approval requirement even after password reset

2. Fix Password Reset Flow

• Prevent password reset for accounts pending approval
• Add account status checks in authentication middleware

3. Implement Proper Access Controls

• Add role-based access control (RBAC) to all API endpoints
• Implement data filtering based on user permissions
• Restrict customer data access to authorized users only
• Add rate limiting to prevent bulk enumeration

References

• OWASP Top 10: A01:2021 - Broken Access Control
• CWE-284: Improper Access Control
• CWE-639: Authorization Bypass Through User-Controlled Key

Impact

Impact

This vulnerability chain has severe security implications:

1. Unauthorized Access

• Attackers can create accounts and access the application without legitimate credentials or authorization
• Complete bypass of the admin validation workflow

2. Sensitive Data Exposure

• Customer Information Disclosure: Complete enumeration of all business customers
• Employee Email Disclosure: Exposure of internal employee email addresses
• Organizational Intelligence: Mapping of employee-customer relationships

3. Phishing Attack Vector

The exposed internal email addresses create a high-risk attack vector:

• Targeted Spear Phishing: Attackers can craft highly convincing phishing emails using legitimate employee addresses and customer context
• Business Email Compromise (BEC): Knowledge of employee-customer relationships enables sophisticated BEC attacks
• Social Engineering: Detailed organizational information facilitates social engineering attacks against employees and customers
• Brand Impersonation: Attackers can impersonate legitimate employees in communications with customers

4. Reputational Risk

• Customer trust erosion if data exposure is discovered
• Potential regulatory compliance violations (GDPR, CCPA, etc.)
• Brand damage from phishing attacks leveraging exposed data