Broken Access Control in Idurar ERP CRM Allows Unauthenticated PDF Downloads

Executive Summary

This vulnerability is a broken access control issue in Idurar ERP CRM 4.1.0. It allows unauthenticated remote attackers to download invoice PDF files containing customer personally identifiable information (PII) via the /download router. The router lacks authentication middleware, making it publicly accessible. Attackers can exploit this by enumerating MongoDB ObjectIds to access any invoice without credentials.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the /download endpoint is publicly accessible without authentication. Use curl commands like 'curl -I http://<target>/download' to verify if the endpoint responds without requiring credentials. Additionally, test if you can access invoice PDFs by guessing or enumerating MongoDB ObjectIds in URLs like '/download?file=<ObjectId>'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to steal sensitive customer data, including PII from invoices. If exploited, it may lead to privacy breaches, identity theft, financial fraud, or reputational damage for affected organizations. The impact depends on the volume of exposed data and the sensitivity of the information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to PII. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and mandatory breach notifications under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /download endpoint by adding authentication middleware. Update the router configuration to require valid user sessions or API keys. If possible, disable direct file downloads or implement IP whitelisting as a temporary measure until a patch is applied.

Useful 0 Not Useful 0