Authenticated File Download in Let's Chat via Broken Access Control

Executive Summary

This vulnerability is a broken access control issue in Let's Chat versions 0.3.0 through 0.4.8. It allows authenticated attackers to download file attachments from private or password-protected rooms they are not members of. The flaw occurs because the file retrieval route only checks if a user is logged in but does not verify room membership or permissions.

Useful 0 Not Useful 0

Detection Guidance

Check if Let's Chat versions 0.3.0 through 0.4.8 are installed. Verify if the /files/:id/:name endpoint is accessible without proper room membership checks. Test by attempting to download files from private rooms using known or guessed file IDs.

Useful 0 Not Useful 0

Impact Analysis

Unauthorized users could access sensitive files in private rooms, including those from revoked users who retain access. Attackers can guess or derive file IDs to retrieve attachments they should not see, leading to data leaks or exposure of confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health information privacy) by allowing unauthorized access to sensitive data. It violates principles of least privilege and data confidentiality required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the files.enable setting if enabled. Implement room membership verification in the file retrieval route. Update to a patched version if available. Restrict access to sensitive files and monitor for unauthorized download attempts.

Useful 0 Not Useful 0