Missing Authorization in MrDoc Allows Document Modification

Executive Summary

This vulnerability in MrDoc through version 1.1.1 is a missing authorization issue in the document sorting handlers. Registered users can modify documents belonging to other users by providing arbitrary document IDs in the sort_data parameter. Attackers can reorder, reparent, or change the status of documents to draft or removed, effectively hiding published documents from other users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect MrDoc's document sorting endpoints for unauthorized access. Check logs for POST requests to /manage_project_doc_sort/ or /manage_pro_doc_sort/<pro_id>/ with arbitrary document IDs in sort_data. Verify if users can modify documents outside their projects. Use Django's admin panel to review document ownership changes or status updates to draft/removed.

Useful 0 Not Useful 0

Impact Analysis

If you use MrDoc, an attacker with a registered account could manipulate your documents by changing their order, moving them to different projects, or marking them as draft or removed. This could disrupt your workflow, hide important documents, or make them inaccessible to other users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized users to modify or hide documents, potentially violating data integrity and access control requirements. Unauthorized document manipulation may lead to unauthorized data exposure or loss of audit trails, which are critical for compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit e2c26d7858289601dde331b205b82ea5e2d2dad1. Update to the latest MrDoc version. Restrict access to document sorting endpoints via firewall rules. Monitor for unauthorized document status changes or reparenting. Review user permissions to ensure only authorized users can modify documents.

Useful 0 Not Useful 0