REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

Summary

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking.

Remediation

1. Inventory every redaxo core deployment, including staging.
2. Upgrade redaxo core to 5.21.5.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/redaxo/core/security/advisories/GHSA-phjc-vx3j-58r3
• Advisoryhttps://www.vulncheck.com/advisories/redaxo-before-5.21.5-privilege-escalation-via-backup-export-of-authentication-tables