Description
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
dataelement bisheng
Default version status: unaffected
0 to ≤ 3.0.0-beta4affected
pkg:github/dataelement/bishengReferences
- https://hackmd.io/@hieuPenguinnn/bisheng-knowledge-file-bbox-cross-user-idor ↗
- https://github.com/dataelement/bisheng/blob/v3.0.0-beta4/src/backend/bisheng/knowledge/api/endpoints/knowledge.py#L663-L670 ↗
- https://github.com/dataelement/bisheng/blob/v3.0.0-beta4/src/backend/bisheng/knowledge/domain/services/knowledge_service.py#L2523-L2533 ↗
- https://github.com/dataelement/bisheng ↗
- https://www.vulncheck.com/advisories/bisheng-through-3.0.0-beta4-idor-via-api-v1-knowledge-file-bbox ↗