CVE-2024-6908: 
YugabyteDB vulnerability analysis and mitigation

A privilege escalation vulnerability was identified in Yugabyte Platform, tracked as CVE-2024-6908. The vulnerability allows authenticated admin users to escalate their privileges to SuperAdmin through a crafted PUT HTTP request. This security issue was discovered and disclosed in July 2024, affecting the Yugabyte Platform's user management system (NVD).

The vulnerability stems from improper privilege management (CWE-269) in the Yugabyte Platform's user management system. The issue specifically involves the ability for admin users to manipulate their role to SuperAdmin through crafted PUT HTTP requests. The vulnerability has been assigned a CVSS 4.0 Base Score of 6.0 (Medium) with the vector string CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H (NVD).

If exploited, this vulnerability could lead to unauthorized access to sensitive system functions and data. The successful exploitation would allow an admin user to gain SuperAdmin privileges, potentially compromising the security and integrity of the entire platform (NVD).

The vulnerability requires an authenticated admin user account to exploit. The attack vector involves crafting specific PUT HTTP requests to escalate privileges to SuperAdmin level. The exploitation requires low attack complexity but high privileges to execute (NVD).

Yugabyte has addressed this vulnerability by implementing fixes that disable the creation of SuperAdmin users and prevent role changes to SuperAdmin. These security patches are available in the repository commits that modify the UsersController.java file to include additional validation checks (GitHub Commit, GitHub Commit).