A critical authentication and server side request forgery vulnerability in OpenProject 17.0.0 through 17.0.1 allows unauthorized actors to impersonate authenticated users.

The synchronization server fails to properly validate the backend URL, allowing an attacker to redirect requests and interact with the OpenProject backend using decrypted authentication tokens. This flaw, categorized under CWE-345, requires an attacker to possess an intercepted token and can be triggered by a logged-in user.

The ability for an attacker to impersonate a legitimate user poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.9, this vulnerability could lead to unauthorized access to sensitive project documents and internal administrative functions, potentially resulting in significant data breaches or unauthorized modification of project assets.

Immediate Action: Update OpenProject and the hocuspocus container to version 17.0.2 or later immediately.

Proactive Monitoring: Review system and application access logs for unusual outbound requests originating from the synchronization server or unexpected authentication patterns.

Compensating Controls: If patching is not immediately feasible, disable the real time collaboration feature via Settings, Documents, and Real time collaboration, and disable the hocuspocus container to eliminate the attack vector.

Public Exploit Available: No

Given the high CVSS severity and the nature of the vulnerability, organizations should prioritize upgrading their OpenProject instances to version 17.0.2. If an immediate update is not possible, the documented workaround of disabling real time collaboration and the hocuspocus container must be implemented to prevent unauthorized access and potential account takeover.