Information Disclosure in OpenSignLabs OpenSign

Executive Summary

This vulnerability is an information disclosure issue in OpenSignLabs OpenSign through version 2.37.0. It allows unauthenticated remote attackers to retrieve any organization's tenant record by using the gettenant Parse cloud function with a contactId parameter. The function returns full tenant details without requiring authentication or authorization checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthenticated requests to the gettenant Parse cloud function. Check logs for unusual access patterns or repeated requests with varying contactId parameters. Use tools like curl to test if the endpoint leaks tenant data without authentication.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive tenant configuration data for any organization using the system. This may include internal settings, user details, or other confidential information, potentially leading to further attacks or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements under GDPR, HIPAA, or other privacy regulations by exposing personal or sensitive data without authorization. Organizations using affected versions may face legal penalties, reputational damage, and loss of trust due to unauthorized data disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update OpenSign to the latest version beyond 2.37.0. Restrict access to the gettenant Parse cloud function by implementing authentication and authorization checks. Review and audit all tenant records for unauthorized access or data exposure.

Useful 0 Not Useful 0