OTOBO 10.1.3 Security Patch

Details on the admin vulnerability and how to handle it in OTOBO:

In OTRS6 and previous OTOBO versions, there is no strict separation between OTOBO administrator rights and permissions on the executing server. Some features explicitly allow server access with the executing program’s rights (e.g., apache2).

For most systems, this will not pose a serious problem, as OTOBO administrators often already have server access. However, there may be systems where OTOBO administrators should not have these permissions.

Fundamentally, it makes sense to have a separation to prevent an attacker who has gained OTOBO administrator rights from finding additional attack vectors on the server.

We have therefore decided to treat these specific functionalities as a security issue and to make them available only after an explicit opt-in by the system administrator in the Config.pm.

To this end, from OTOBO 10.0.16 / 10.1.3 onwards, the following options from Kernel/Config/Defaults.pm must be copied into Kernel/Config.pm and activated there:

• Ticket::GenericAgentAllowCustomScriptExecution
• DashboardBackend::AllowCmdOutput