CVE-2023-45024

What it actually does

Allows unauthenticated information disclosure of transaction records by abusing the transaction query builder to perform searches that bypass intended access controls.

Why it matters to the business

Attackers can obtain sensitive internal ticket and workflow data, increasing the risk of data leakage in organizations that rely on the affected Request Tracker deployments.

How an attack unfolds

An attacker interacts with the publicly reachable transaction query builder endpoint and submits crafted search parameters that cause the application to return transaction details that should have been restricted.

How to fix it

Upgrade Best Practical Request Tracker to version 5.0.5 or newer. On Debian 11 systems install the fixed package version 5.10.216-1.

How to confirm the fix worked

Confirm the running RT version is 5.0.5 or later and that the Debian package is at least 5.10.216-1; attempt sample unauthorized transaction searches to verify they no longer succeed.

Typical attack path

1. Locate an exposed Request Tracker 5 instance
2. Access the transaction query builder interface
3. Submit maliciously constructed search queries targeting transaction data
4. Parse responses to extract disclosed transaction records

How to detect it

Examine web server and application logs for repeated or unusual requests to the transaction search endpoints that return large volumes of data without prior authentication context.

What your security team should do

• Apply the available package or source upgrade without delay
• Review web access logs for anomalous transaction query patterns
• Limit exposure of the query builder to authenticated users only where feasible