CVE-2024-23792

What it actually does

Authenticated users can bypass authorization checks on ticket comment attachments by supplying a known UUID, allowing them to append files under another user's identity while the legitimate comment is still being finalized.

Why it matters to the business

Ticket records can be altered without authorization, leading to loss of data integrity, potential compliance violations, and erosion of trust in the ticketing platform used across organizations.

How an attack unfolds

An attacker who is already logged in obtains the UUID of a comment being edited by another user, then issues concurrent attachment upload requests using that UUID before the legitimate user finishes the comment, resulting in files being added under the impersonated identity.

How to fix it

Upgrade OTRS to versions beyond 7.0.48, 8.0.37, and 2023.1.1 respectively. Until patches are applied, restrict attachment functionality or implement additional server-side UUID validation and session binding for comment operations.

How to confirm the fix worked

Review release notes for versions after the listed affected ranges, test attachment workflows with multiple concurrent authenticated sessions, and confirm that UUID reuse across sessions is rejected.

Typical attack path

1. Gain authenticated access to the OTRS instance
2. Discover or intercept the UUID of an in-progress ticket comment
3. While the target user is actively adding attachments, submit parallel attachment requests using the captured UUID
4. Verify successful addition of unauthorized files to the completed comment

How to detect it

Examine web server and application logs for multiple attachment upload requests sharing the same comment UUID from different authenticated sessions within a short time window; look for attachment records created after initial comment submission but before finalization.

What your security team should do

• Prioritize upgrade of all OTRS instances to patched releases
• Monitor authentication and attachment API endpoints for anomalous concurrent usage patterns
• Temporarily disable attachment uploads if immediate upgrade is not feasible