Executive Summary

This vulnerability is an unauthenticated information disclosure issue in Newgen OmniDocs. It occurs because the /omnidocs/GetListofCabinet API endpoint lacks proper authentication and access control, allowing a remote attacker to access it without valid credentials. As a result, the attacker can retrieve sensitive internal configuration information such as cabinet names and database-related metadata, which could be used to understand backend deployment details and plan further attacks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by exposing sensitive internal configuration information to unauthorized users. This exposure can lead to unauthorized enumeration of backend deployment details, potentially enabling attackers to craft more targeted and effective attacks against your system, increasing the risk of data breaches or system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the /omnidocs/GetListofCabinet API endpoint without authentication and checking if sensitive internal configuration information is returned. A simple command using curl to test this would be: curl -v http://<target-host>/omnidocs/GetListofCabinet If the response contains cabinet names or database metadata without requiring credentials, the system is vulnerable. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing proper authentication and access control on the /omnidocs/GetListofCabinet API endpoint to prevent unauthenticated access. Additionally, restrict network access to this endpoint to trusted users only and monitor access logs for unauthorized attempts. [1]

Useful 0 Not Useful 0