CVE-2021-36801: Akaunting Authentication Bypass in Company Selection

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• akaunting akauntingup to 2.1.12 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (rapid7). Independent of NVD's CPE analysis and usually ahead of it.

• Akaunting Akaunting

  • 2.1.12 and later · up to and including 2.1.12affected

Other highest-scoring records for the same primary product.

• CVE-2024-22836An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.
  48Plan
• CVE-2021-36800Akaunting OS Command Injection in 'Money.php'
  36Monitor
• CVE-2022-51019Akaunting before 2.1.31 OS Command Injection via app alias
  35Monitor

Published before and after this one in the same product

• ← EarlierCVE-2020-22390Jun 21, 2021 · Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function.
  35Monitor
• Later →CVE-2021-36802Aug 4, 2021 · Akaunting DoS via User-Controlled 'locale' Variable
  26Monitor
• Later →CVE-2021-36803Aug 4, 2021 · Akaunting Avatar Persistent XSS
  21Monitor

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.