Authorization Bypass in Movim via Post::ajaxGetPost

Executive Summary

Movim through 0.35.5 has an authorization bypass flaw in the Post::ajaxGetPost function. Authenticated users can read restricted posts by providing server, node, and nodeid values. Attackers with item identifiers can access cached community or contact-only posts before XMPP authorization checks occur.

Useful 0 Not Useful 0

Detection Guidance

Check Movim version with 'movim --version' or inspect the Post.php file for the ajaxGetPost function. Look for cached post handling logic before XMPP authorization checks in app/Widgets/Post/Post.php.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access private posts they shouldn't see if they know the post identifiers. This could expose sensitive information shared only with specific users or communities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to restricted posts, potentially exposing sensitive user data. This could violate GDPR's data protection principles if personal data is accessed without proper authorization. For HIPAA, if the platform handles protected health information, unauthorized access to restricted posts may breach confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Movim to a patched version or apply the commit 378e036 which removes cached post display logic before XMPP checks. Remove server, node and nodeid parameters from user input handling in Post::ajaxGetPost.

Useful 0 Not Useful 0