Description
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AtalayaLabs OxiCloud
Default version status: unaffected
0.9.1 to ≤ 0.9.3affected
pkg:github/AtalayaLabs/OxiCloudReferences
- https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked ↗
- https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538 ↗
- https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195 ↗
- https://github.com/AtalayaLabs/OxiCloud ↗
- https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie ↗