Description
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenSignLabs OpenSign
Default version status: unaffected
0 to ≤ 2.41.3affected
References
- https://github.com/OpenSignLabs/OpenSign/issues/2218 ↗
- https://github.com/OpenSignLabs/OpenSign ↗
- https://github.com/OpenSignLabs/OpenSign/blob/v2.41.0/apps/OpenSignServer/cloud/parsefunction/getDocument.js#L20-L32 ↗
- https://www.vulncheck.com/advisories/opensign-through-2.41.3-information-disclosure-via-getdocument ↗