statping-ng 0.93.0 treats any valid user API key as full authentication for routes protected by the admin middleware. A non-admin user API key can be used to invoke administrative endpoints such as user creation.
handlers/authentication.go::hasAPIQuery() accepts the api query parameter when it matches either the global core.App.ApiSecret or a value in users.api_key. It does not require the matched user key to belong to an administrator.
handlers/handlers.go::IsFullAuthenticated() accepts hasAPIQuery() as sufficient full authentication. Routes such as POST /api/users are protected by authenticated(...), so they trust that result before any administrator-role boundary is enforced.
The attacker-controlled input is the api query parameter containing a normal user's API key. The missing rule is distinguishing user API keys from administrator-grade credentials before allowing admin-only route handlers to run.
- Obtain the API key for a normal non-admin statping-ng 0.93.0 user.
- Send
POST /api/users?api=<non_admin_user_api_key>with a request body for a new user account marked as administrator. - Observe that the request passes
IsFullAuthenticated()throughhasAPIQuery(). - Query the user list or log in as the newly created account.
- Confirm that the new administrator user exists and can access administrative functionality.
The observed result is administrative account creation using a non-admin user's API key. An attacker with any valid non-admin API key can gain persistent full administrative control of the Statping instance.