Impact

OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the reassign_to_id parameter.

Patches

The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4.

Workarounds

If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch

References

• #9983
• https://www.openproject.org/docs/release-notes/12-0-4/

Credits

This security issue was responsibly disclosed by Daniel Santos (Twitter @bananabr). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our statement on security.

For more information

If you have any questions or comments about this advisory:

• Open an issue in our community
• Email us at security@openproject.com, PGP keys can be found at https://github.com/opf/openproject/security/policy