Missing Authorization in Scripta eScriptorium OCR Model Views

Executive Summary

This vulnerability involves missing authorization checks in the OcrModelRight create and delete views of Scripta eScriptorium. A remote authenticated user can exploit this to grant themselves access to another user's private OCR model or revoke any user's OCR model access via a POST request. The issue occurs because the ownership check only runs during the GET rendering path in the get_context_data() method.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing authorization in OcrModelRight views in Scripta eScriptorium. To detect it, inspect HTTP POST requests to /ocr-model-right/create/ and /ocr-model-right/delete/ endpoints for unauthorized access attempts. Check server logs for requests where users modify or delete OCR models not owned by them.

Useful 0 Not Useful 0

Impact Analysis

If you use Scripta eScriptorium, an attacker with authenticated access could modify your OCR model permissions without authorization. They could gain unauthorized access to your private OCR models or remove your access to models you legitimately own, potentially disrupting your workflow or data integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of sensitive data (OCR models), which may violate GDPR's data protection principles or HIPAA's access control requirements. Organizations using this software may face compliance risks due to potential data exposure or integrity breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update Scripta eScriptorium to the latest version where the vulnerability is patched. If an update is not available, review and modify the OcrModelRight views to ensure proper authorization checks are performed before processing POST requests, not just during GET rendering.

Useful 0 Not Useful 0