CVE-2023-30059: MK-Auth IDOR Auth Bypass Vulnerability

CVE-2023-30059 Overview

CVE-2023-30059 is an Insecure Direct Object Reference (IDOR) vulnerability in MK-Auth version 23.01K4.9. The flaw resides in the support ticket (chamado) handling logic. An authenticated attacker can manipulate the chamado parameter in a crafted GET request to access and send support calls belonging to other users. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated users can read and submit support tickets on behalf of other MK-Auth users, breaking tenant and account isolation in a platform commonly deployed by Internet Service Providers.

Affected Products

MK-Auth 23.01K4.9

Discovery Timeline

2026-05-12 - CVE-2023-30059 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2023-30059

Vulnerability Analysis

MK-Auth is an authentication and billing management platform used by Brazilian ISPs to manage customer accounts, support tickets, and network access. CVE-2023-30059 exists in the support ticket workflow, where the application exposes ticket identifiers through the chamado GET parameter. The application trusts the user-supplied identifier without verifying that the requesting account owns the referenced ticket.

An attacker who holds any valid MK-Auth account can iterate or guess chamado values to read other customers' support tickets. The same parameter can be used to submit support calls attributed to a different user account. This breaks confidentiality of customer correspondence and integrity of the support workflow.

The Exploit Prediction Scoring System (EPSS) places this issue at a low probability of observed exploitation, reflecting its niche product footprint. Exploitation still requires only standard web tooling and a low-privileged account.

Root Cause

The root cause is missing object-level authorization on the support ticket endpoint. MK-Auth uses the chamado request parameter as a direct database key but does not enforce a server-side check that the authenticated session owns the referenced record. Authorization decisions rely on the presence of a session rather than on resource ownership.

Attack Vector

The attack is delivered over the network by an authenticated user. The attacker logs into MK-Auth, then issues a crafted GET request that substitutes another user's ticket identifier into the chamado parameter. The server returns the targeted ticket or processes an action against it. No user interaction from the victim is required.

No verified exploitation code is published in the enriched dataset. A proof-of-concept repository is referenced at GitHub PoC Repository, which describes the parameter manipulation technique.

Detection Methods for CVE-2023-30059

Indicators of Compromise

GET requests to MK-Auth support endpoints containing chamado values that do not belong to the authenticated session user.
Sequential or enumerated chamado identifiers originating from a single source IP or session within a short time window.
Support tickets created or modified from a session whose authenticated user differs from the ticket owner recorded in the database.

Detection Strategies

Correlate web server access logs with application session data to flag mismatches between session user and the owner of the referenced chamado record.
Deploy web application firewall rules that baseline normal chamado access patterns per account and alert on horizontal enumeration.
Review database audit logs for support ticket reads or writes that cross account boundaries.

Monitoring Recommendations

Forward MK-Auth application and web server logs to a centralized logging platform for correlation against authentication events.
Alert on any account producing high rates of distinct chamado parameter values, which suggests enumeration.
Monitor for unexpected support ticket activity outside business hours or from atypical geolocations.

How to Mitigate CVE-2023-30059

Immediate Actions Required

Restrict access to the MK-Auth administrative and support interfaces to trusted networks or VPN until a patched build is deployed.
Audit existing support tickets for unauthorized access or fraudulent submissions made through the chamado parameter.
Rotate credentials for accounts suspected of being used to exploit the IDOR.

Patch Information

No vendor advisory or patched version is referenced in the enriched data for MK-Auth 23.01K4.9. Operators should contact the MK-Auth vendor for a fixed release and apply it as soon as it becomes available.

Workarounds

Implement a reverse proxy rule that inspects requests to support ticket endpoints and rejects chamado values that do not match the authenticated session's account identifier.
Disable the affected support ticket feature for non-administrative users until the application enforces server-side ownership checks.
Increase logging granularity on the support module to capture session user, source IP, and referenced ticket ID for every request.

bash

# Example NGINX snippet to log chamado parameter access for review
log_format mkauth_idor '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      'chamado=$arg_chamado session=$cookie_PHPSESSID';

location /central/ {
    access_log /var/log/nginx/mkauth_chamado.log mkauth_idor;
    proxy_pass http://mkauth_backend;
}