CVE-2021-43833 : Security Advisory and Response

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0, there is a vulnerability that allows any authenticated user to access arbitrary accounts by manipulating email addresses. This CVE-2021-43833 impacts instances without a configured email domain allowlist, potentially leading to unauthorized access.

Understanding CVE-2021-43833

What is CVE-2021-43833?

CVE-2021-43833 is a vulnerability in eLabFTW that permits authenticated users to gain unauthorized access to other accounts via crafted email addresses.

The Impact of CVE-2021-43833

The impact of this vulnerability can be severe:

CVSS Base Score: 8.1 (High Severity)
Access: Low privileges required
Confidentiality Impact: High
Integrity Impact: High
Attack Complexity: Low, accessible via network

Technical Details of CVE-2021-43833

Vulnerability Description

The vulnerability arises from improper authentication in eLabFTW, enabling users to exploit crafted email addresses to access unauthorized accounts.

Affected Systems and Versions

Affected Product: eLabFTW
Vendor: eLabFTW
Vulnerable Versions: < 4.2.0

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Exploitation requires an authenticated user setting a specially crafted email address.

Mitigation and Prevention

Immediate Steps to Take

Upgrade to version 4.2.0 or later to patch the vulnerability.
Configure an email domain allow list via the Sysconfig panel, Security tab.

Long-Term Security Practices

Regularly update the eLabFTW software to the latest version.
Implement rigorous account validation processes to prevent unauthorized access.

Patching and Updates

Update eLabFTW to at least version 4.2.0 to eliminate this vulnerability.