Executive brief
APTRS, an automated reporting tool for penetration testers, contains a security flaw that allows users with basic administrative permissions to grant themselves full superuser access. By sending a specially crafted request to the user-editing interface, an attacker can bypass intended restrictions and gain unrestricted control over the entire system. This could lead to the exposure of sensitive security reports, unauthorized modification of user accounts, and complete system compromise.
Technical details
A privilege escalation vulnerability exists in APTRS prior to version 2.0.1 due to improper input validation in the 'edit_user' endpoint (POST /api/auth/edituser/<pk>). The 'CustomUserSerializer' includes the 'is_superuser' field in its writable fields list but fails to include it in 'read_only_fields'. An authenticated attacker with 'Manage Users' permissions (typically a staff-level account) can exploit this mass assignment vulnerability by submitting a JSON body containing '"is_superuser": true'. This allows the attacker to bypass Django's permission model and gain full administrative access without re-authentication. The issue is resolved in version 2.0.1 by making the field read-only in the serializer.
Affected products
- APTRS APTRS (Automated Penetration Testing Reporting System) < 2.0.1
Timeline
- 2025-03-19: disclosed: Vulnerability discovered and reported to vendor
- 2026-03-31: patched: Version 2.0.1 released
- 2026-03-31: advisory: GitHub Security Advisory published