Authentication Bypass in OpenSignLabs OpenSignServer

Executive Summary

This vulnerability is a missing authentication issue in OpenSignLabs opensignserver version 2.37.0 or earlier. It allows an unauthenticated remote attacker to read any stored documents by exploiting the fileupload Parse cloud function. The function creates file access tokens signed with a MASTER_KEY for any URL provided by the attacker without checking if the requester is authorized, bypassing the only access control protecting stored contract files.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenSignLabs opensignserver through version 2.37.0, an attacker could access and read all stored documents without any authentication. This includes sensitive contracts and files, leading to unauthorized data exposure and potential privacy breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access to sensitive personal or health data. GDPR requires strict access controls and data protection, while HIPAA mandates safeguards for protected health information. The lack of authentication controls here could result in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update OpenSignLabs opensignserver to the latest version beyond 2.37.0 to patch the missing authentication vulnerability. Disable the fileupload Parse cloud function if not required. Implement network-level access controls to restrict unauthorized access to stored documents.

Useful 0 Not Useful 0