Unauthenticated File Access in EdgeChat

Executive Summary

EdgeChat before version 2.20.3 has a missing authentication vulnerability in the GET /files/:key route. This flaw allows unauthenticated or banned users to download decrypted public-channel attachments because the canAccessFile() function incorrectly accepts a null user ID. Attackers with an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.

Useful 0 Not Useful 0

Detection Guidance

Check EdgeChat logs for unauthorized GET /files/:key requests with null or invalid tokens. Monitor for repeated access attempts to known attachment keys without valid sessions. Verify if canAccessFile() in uploaded-files.js accepts null user IDs by inspecting the function logic.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized access to decrypted public-channel attachments if an attacker knows the specific object key. Banned or removed users can permanently access these files. Private-channel and direct-message attachments remain protected as they require channel membership.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade EdgeChat to version 2.20.3 or later. Ensure the GET /files/:key endpoint enforces strict user ID validation. Block unauthenticated requests to /files/:key and redirect to /api/messages for access control. Review and remove public access to decrypted attachments if not required.

Useful 0 Not Useful 0