Description
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OtterMind Nubase
Default version status: unaffected
0 to ≤ 0.1.4affected
pkg:github/OtterMind/NubaseReferences
- https://hackmd.io/@hieuPenguinnn/nubase-storage-private-object-unauth-download ↗
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/common/multitenancy/UnifiedMultiTenancyFilter.java#L363-L379 ↗
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/controller/storage/StorageObjectReadController.java#L68-L74 ↗
- https://github.com/OtterMind/Nubase/blob/v0.1.4/src/main/java/ai/nubase/auth/service/StorageService.java#L176-L200 ↗
- https://www.vulncheck.com/advisories/ottermind-nubase-through-0.1.4-missing-authentication-in-storage-object-api ↗