Cloudreve WOPI Token Validation Bypass Leading to File Write

Executive Summary

Cloudreve before version 4.17.0 has a vulnerability in ViewerSessionValidation where it only checks the session-id prefix of a WOPI access token. This allows a malicious or compromised WOPI viewer with a view session to forge the token suffix and use write routes for files, leading to unauthorized modifications.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Cloudreve versions prior to 4.17.0. Inspect WOPI access tokens for improper validation where only the session ID prefix is checked. Look for unauthorized file modifications or unexpected write operations from view-only sessions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to modify files without proper authorization, potentially altering or deleting sensitive data stored in Cloudreve. This could lead to data loss or unauthorized changes to files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data modifications or access, violating integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is altered without authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Update Cloudreve to version 4.17.0 or later to address the vulnerability. Ensure all instances are upgraded to prevent exploitation.

Useful 0 Not Useful 0