Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID.
Because the server matches only pk, workspace, and project_id, it modifies the attachment regardless of the issue_id in the URL. When the attachment is pending and has not been confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker. This issue is fixed in 1.4.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
makeplane:plane
References 4
https://github.com/makeplane/plane/security/advisories/GHSA-5mxw-g5mw-3v3w
https://github.com/makeplane/plane/security/advisories/GHSA-5mxw-g5mw-3v3w
https://github.com/makeplane/plane/pull/9315
https://github.com/makeplane/plane/pull/9315
https://github.com/makeplane/plane/commit/5829f0febf0739494d576b60d4943d10d236b…
https://github.com/makeplane/plane/commit/5829f0febf0739494d576b60d4943d10d236bc96
https://github.com/makeplane/plane/releases/tag/v1.4.0
https://github.com/makeplane/plane/releases/tag/v1.4.0