Description
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard endpoints to retrieve serialized datasource host, port, username and cleartext passwords.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
devlive-community DataCap
Default version status: unaffected
0 to ≤ 2025.1.1affected
pkg:github/devlive-community/MetaForgeReferences
- https://hackmd.io/@hieuPenguinnn/metaforge-datacap-source-getbyid-cross-user-idor ↗
- https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-service/src/main/java/io/edurt/datacap/service/service/BaseService.java#L38-L43 ↗
- https://github.com/devlive-community/MetaForge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/BaseController.java#L91-L95 ↗
- https://www.vulncheck.com/advisories/datacap-through-2025.1.1-idor-via-basecontroller-getinfoforpath-exposes-credentials ↗