Description
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
haiwen seahub
Default version status: unaffected
0 to < 13.0.23affected
pkg:github/haiwen/seahubReferences
- https://plus.seafile.com/wiki/publish/seafile-wiki/v5D5/ ↗
- https://github.com/haiwen/seahub/issues/9050 ↗
- https://github.com/haiwen/seahub/commit/b609949cf64ed6a15708d0fb5ea9c179962e23cc ↗
- https://github.com/haiwen/seahub/commit/162cddae0831188d02bb8d451dc2193e197dcc57 ↗
- https://www.vulncheck.com/advisories/seahub-authentication-bypass-in-sharelinkziptaskview-get-method ↗