Executive Summary

This vulnerability exists in eLabFTW, an open source electronic lab notebook, in versions prior to 5.4.2. It allows an authenticated user performing a numeric reference or search to receive results that include titles of resources they are not authorized to view. However, the actual content of these protected resources remains inaccessible due to authorization checks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information if confidential data is included in the titles of resources. For example, project names, patient identifiers, or other regulated information embedded in titles could be exposed to users without proper authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with standards and regulations such as GDPR and HIPAA because it can result in unauthorized disclosure of sensitive or regulated information contained in resource titles. Even though the full content remains protected, exposure of confidential identifiers or personal data in titles could violate data protection and privacy requirements.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade eLabFTW to version 5.4.2 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves verifying if an authenticated user can perform numeric reference or search queries that return titles of resources outside their authorized scope.

One approach is to log in with a standard user account and execute numeric search queries or reference lookups within the eLabFTW application to see if titles of unauthorized resources are returned.

Since the vulnerability is related to the application behavior rather than a network signature, detection commands would be application-specific HTTP requests simulating numeric searches.

For example, using curl to perform an authenticated numeric search request might look like this:

• curl -i -H "Cookie: session=YOUR_SESSION_COOKIE" "https://your-elabftw-instance/api/search?query=12345"

Replace YOUR_SESSION_COOKIE with a valid session cookie for an authenticated user and adjust the query parameter to numeric values. If the response includes titles of resources not authorized for that user, the vulnerability is present.

Additionally, reviewing application logs for unusual numeric search queries returning unexpected titles may help detect exploitation attempts.

Useful 0 Not Useful 0