Description
abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
colinin abp-next-admin
Default version status: unaffected
10.4.0 to ≤ 10.7.0affected
References
- https://github.com/colinin/abp-next-admin/pull/1633 ↗
- https://github.com/colinin/abp-next-admin/commit/3ea383093d51b18984652fc9b2d3dcc779a372ee ↗
- https://github.com/colinin/abp-next-admin ↗
- https://github.com/colinin/abp-next-admin/issues/1628 ↗
- https://github.com/colinin/abp-next-admin/commit/fc5e6d5a8a11a65e06fe001fe4a55e414956fc0c ↗
- https://github.com/colinin/abp-next-admin/blob/10.7.0/aspnet-core/modules/blob-management/LINGYUN.Abp.BlobManagement.Application/LINGYUN/Abp/BlobManagement/BlobAppService.cs#L60-L68 ↗
- https://hackmd.io/@hieuPenguinnn/abp-next-admin-blob-download-by-name-cross-tenant-idor ↗
- https://www.vulncheck.com/advisories/abp-next-admin-10.4.0-through-10.7.0-cross-tenant-file-disclosure-via-blob-download-by-name ↗