Plane Project Management Tool Asset Hijacking Vulnerability

Plane, an open-source project management tool, has patched a broken access control vulnerability in its bulk asset endpoint.

Prior to version 1.4.0, ProjectBulkAssetEndpoint.post retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL. A workspace Guest can provide asset UUIDs from another project in the same workspace and reassign issue_id, comment_id, page_id, draft_issue_id, or project_id to an entity the attacker controls.

Plane then treats the attacker's project as the new owner and provides a presigned download URL for the hijacked file.

• Affects versions prior to 1.4.0.
• Requires workspace Guest access and knowledge of asset UUIDs from another project in the same workspace.
• Fixed in 1.4.0.