Missing Authorization in Zipline Lets Users Reparent Files

Executive Summary

Zipline before version 4.6.2 has a missing authorization vulnerability in the POST /api/user/folders endpoint. This flaw allows authenticated users to reparent files belonging to other users by providing their file IDs. Attackers can exploit this by collecting file IDs from public folders and creating a new folder seeded with those IDs. This exposes victims' file URLs and removes the files from the victims' folder views.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /api/user/folders and /api/upload endpoints. Check for unusual file reparenting or uploads to unauthorized folders. Review logs for authenticated users accessing files not belonging to them.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access your private file URLs, move your files to their folders without deleting them, and remove those files from your view. This could lead to unauthorized access to your file metadata and structure, though file content remains intact.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Zipline to version 4.6.2 or later. Implement strict ownership checks in the /api/user/folders and /api/upload endpoints. Restrict folder access permissions and audit existing file permissions.

Useful 0 Not Useful 0