Missing Authorization in MrDoc Exposes User Document Templates

Executive Summary

This vulnerability is a missing authorization issue in MrDoc version 1.1.1. The get_doctemp view allows authenticated users to read other users' private document templates by exploiting sequential template IDs. The application fails to verify ownership when accessing templates, enabling unauthorized access to sensitive content.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your MrDoc instance allows unauthenticated users to access document templates via sequential IDs. Test by sending POST requests to the get_doctemp endpoint with varying doctemp_id values while authenticated. If responses include templates not created by your user, the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

If you use MrDoc v1.1.1, an attacker with a valid account could access your private document templates by guessing or enumerating template IDs. This could lead to exposure of sensitive information stored in those templates, such as confidential documents or proprietary content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing personal or health-related data stored in document templates. Unauthorized access to such data may result in non-compliance with data protection requirements, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update MrDoc to the latest patched version. If updating is not possible, apply the fix manually by modifying the get_doctemp function in app_doc/views.py to include create_user=request.user in the query. Restrict network access to the MrDoc instance and audit user permissions.

Useful 0 Not Useful 0