Description
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
javahuang SurveyKing
Default version status: unaffected
0 to < 1.13.0affected
pkg:github/javahuang/SurveyKingReferences
- https://hackmd.io/@hieuPenguinnn/surveyking-public-preview-unauth-file-read ↗
- https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/api/src/main/java/cn/surveyking/server/api/SurveyApi.java#L99-L107 ↗
- https://github.com/javahuang/SurveyKing/blob/6e1fdd59f9b331ac90a26402ac86a002cc9155a9/server/rdbms/src/main/java/cn/surveyking/server/impl/FileServiceImpl.java#L197-L228 ↗
- https://github.com/javahuang/SurveyKing/commit/9489171d53e55ace2856a91af38034665c0064a4 ↗
- https://github.com/javahuang/SurveyKing ↗
- https://www.vulncheck.com/advisories/surveyking-before-1.13.0-unauthenticated-file-download-via-api-public-preview ↗