Insecure Direct Object Reference in R-SOFT DMS File Download

Executive Summary

The vulnerability in R-SOFT DMS is an Insecure Direct Object Reference (IDOR) attack affecting multiple file download endpoints. The application retrieves files from the database based on an ID and serves them to any requester who is authenticated in the session. However, it does not verify whether the requesting user is authorized to access the specific file, allowing any valid user to access any file.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files by any authenticated user. Since the application does not restrict file access based on user permissions, confidential or private data could be exposed to users who should not have access, potentially leading to data breaches or information leakage.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade R-SOFT DMS to version v3.19-2862 or v3.17-2580, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in R-SOFT DMS allows any valid user to access any file by exploiting an Insecure Direct Object Reference (IDOR) in multiple file download endpoints. This means unauthorized access to sensitive files is possible, which can lead to data breaches.

Such unauthorized access to files can impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data to prevent unauthorized disclosure.

Therefore, this vulnerability could lead to violations of these standards by failing to adequately protect sensitive information from unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability in R-SOFT DMS is an Insecure Direct Object Reference (IDOR) in multiple file download endpoints, where files are served based solely on file IDs and session authentication. Detection involves verifying if unauthorized users can access files by manipulating file ID parameters in requests.

To detect this vulnerability on your system or network, you can attempt to access files by changing the file ID parameter in the download URLs while authenticated as a valid user. If you can access files that should not be accessible to your user, the system is vulnerable.

Suggested commands include using tools like curl or wget to test file access by modifying file ID parameters. For example:

• curl -b cookies.txt "https://target-domain/download?file_id=123" -o file123
• curl -b cookies.txt "https://target-domain/download?file_id=124" -o file124

Here, cookies.txt contains valid session cookies. By changing the file_id parameter to IDs of files you should not have access to, you can check if unauthorized file downloads are possible.

Additionally, monitoring logs for unusual file access patterns or requests with manipulated file IDs can help detect exploitation attempts.

Useful 0 Not Useful 0