Description
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenListTeam OpenList
< 4.2.4affected
References
- https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337 ↗
- https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a ↗
- https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679 ↗
- https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4 ↗