Authorization Bypass in Scripta eScriptorium Serializers

Executive Summary

This vulnerability is an authorization bypass in Scripta eScriptorium through version 26.04.1. It allows a remote authenticated user to perform segmentation and transcription on other users' document parts, potentially overwriting their content. The issue occurs due to incorrect application of queryset restrictions in the serializers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves authorization bypass in Scripta eScriptorium's serializers. To detect it, inspect the application logs for unauthorized access attempts to document parts or segmentation/transcription operations performed by non-owners. Check for requests containing part primary keys in many=True related fields that modify other users' content. Review the ManyRelatedField usage in the serializers to ensure queryset restrictions are applied correctly to child_relation.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of Scripta eScriptorium, an attacker with valid credentials could modify or overwrite your document parts without authorization. This could lead to data loss, corruption, or unauthorized changes to your work.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized access and modification of sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized changes could violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Scripta eScriptorium to version 26.04.1 or later to address the authorization bypass issue in the serializers.

Useful 0 Not Useful 0