Description
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity() to break existing share links and hijack the freed codes with their own uploads.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sergix44 XBackBone
Default version status: unaffected
0 to ≤ 3.8.2affected
References
- https://github.com/sergix44/xbackbone/pull/671 ↗
- https://github.com/sergix44/xbackbone/commit/5e91a2a9859d20e41ee2e2403cfbe673804f6221 ↗
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ByAj-Xoifl ↗
- https://github.com/sergix44/xbackbone/blob/226af4f0cec218f563da6d53ececfa4708e6f3e7/app/Controllers/MediaController.php#L204-L229 ↗
- https://github.com/sergix44/xbackbone ↗
- https://www.vulncheck.com/advisories/xbackbone-through-3.8.2-missing-authorization-via-upload-vanity-endpoint ↗