Description

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-03T15:17:40.567Z",
  "pubdate": "2026-09-03T15:17:40.567Z",
  "executiveSummary": "Kill Bill versions through 0.24.21 contain a critical authorization bypass vulnerability within the AdminResource API endpoints.\nThe vulnerability allows authenticated users possessing minimal 'account:read' permissions to execute unauthorized administrative functions.\nImpacted operations include the retrieval of sensitive internal queue entries, the forced invalidation of server-side caches, and the manipulation of host rotation status.\nThis represents a significant security failure where the application backend fails to enforce proper Access Control Lists (ACLs) or permission annotations on sensitive administrative controllers.\nSuccessful exploitation enables unauthorized users to potentially disrupt service availability, compromise data privacy via queue inspection, and perform operational sabotage through cache poisoning or denial-of-service by removing nodes from rotation.\nThe risk is high for multi-tenant or shared environments where low-privileged users are granted basic account access but should remain strictly isolated from infrastructure-level administrative commands.",
  "technicalDetails": "The vulnerability resides within the AdminResource component of the Kill Bill platform, specifically concerning the handling of incoming HTTP requests for administrative tasks.\nThe root cause is a failure in the security interceptor logic or missing JAX-RS/Shiro permission annotations on specific API endpoints, namely getQueueEntries, invalidatesCache, and putOutOfRotation.\nIn the Kill Bill architecture, administrative endpoints are expected to be guarded by robust role-based access control (RBAC). However, the implementation fails to enforce these checks consistently, allowing requests that do not meet the elevated permission criteria to pass through the validation layer.\nThe attack flow begins with an attacker obtaining a legitimate session token with the minimum 'account:read' privilege scope. The attacker then targets the vulnerable AdminResource endpoints using standard HTTP methods (GET for queue inspection, POST/DELETE for cache and rotation control). Because the application controller logic lacks the required 'Admin' or equivalent permission annotations, the security layer processes the request as authorized.\nExploitation steps: First, the attacker identifies the target API path. Second, the attacker crafts a malicious request (e.g., calling /1.0/kb/admin/queues to trigger getQueueEntries). Third, the system evaluates the request and, due to the missing annotation, grants access to the underlying administrative method. Finally, the server executes the command—such as flushing server caches, which could lead to performance degradation, or toggling the server out of rotation, effectively causing an application-level denial-of-service (DoS) for that specific node.\nThe scope of impact is broad, extending from information disclosure of internal processing queues—which may contain sensitive transaction metadata—to unauthorized infrastructure management. The vulnerability exists in all versions up to and including 0.24.21, and there is no evidence of secondary verification mechanisms preventing these unauthorized calls if the initial access check is bypassed."
}