Missing Authorization in Scripta eScriptorium Websocket Consumer

Executive Summary

This vulnerability involves missing authorization in the websocket consumer of Scripta eScriptorium. A remote authenticated user can exploit it by subscribing to any document's event stream. This allows them to observe another user's activities such as segmentation, transcription, import, export, and training via specific message values without proper access checks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing authorization in websocket consumer handling. To detect it, monitor websocket traffic for unauthorized subscription attempts to document event streams. Check logs for group_add operations with object_cls and object_pk values that bypass access controls. Inspect network traffic for join-room messages with suspicious parameters.

Useful 0 Not Useful 0

Impact Analysis

If you use Scripta eScriptorium, an attacker with valid credentials could monitor your document activities. This may lead to unauthorized access to sensitive data like transcription content or training processes, potentially exposing private or confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized access to personal or health-related data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access risks non-compliance and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update Scripta eScriptorium to version 26.04.1 or later to address the missing authorization in the websocket consumer.

Useful 0 Not Useful 0