Authenticated Users Can Modify Article Visibility in Zr.Admin.NET via Insecure Direct Object Reference

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Zr.Admin.NET application. It allows authenticated users to change other users' article visibility and pin state by sending a PUT request to /front/article/changePublic with a modified UserId in the request body. Attackers can make private articles public and then read them anonymously via GET /front/article/{id}.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PUT requests to /front/article/changePublic with modified UserId in the request body. Monitor for GET requests to /front/article/{id} accessing articles that should be private. Review logs for suspicious activity in FrontArticleController endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of Zr.Admin.NET, an attacker with access could change your private articles to public, exposing sensitive content. This could lead to unauthorized access to confidential information, data leaks, or reputational damage if proprietary or personal data is exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and failing to ensure data confidentiality. For HIPAA, it may lead to unauthorized access to protected health information, breaching compliance requirements for safeguarding sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Update Zr.Admin.NET to a version beyond commit eb9228a. Implement strict input validation for UserId in PUT /front/article/changePublic. Enforce authorization checks to ensure users can only modify their own articles. Restrict direct object references by using indirect references like UUIDs instead of sequential IDs.

Useful 0 Not Useful 0