Authentication Bypass in OpenSignLabs OpenSignServer via Parse Cloud Function

Executive Summary

This vulnerability is an authentication bypass in OpenSignLabs opensignserver version 2.37.0 or earlier. It allows an unauthenticated remote attacker to generate file access tokens signed by the MASTER_KEY for any stored file by exploiting the getsignedurl Parse cloud function. The function fails to perform authentication checks when any docId parameter is provided, even if the docId does not correspond to an existing document.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access attempts to the getsignedurl endpoint with arbitrary docId parameters. Monitor server logs for requests to /opensignserver/Parse with docId values that do not correspond to valid documents. Look for repeated failed authentication attempts or unusual access patterns to file endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive files without proper authorization. This could lead to unauthorized data exposure, data theft, or further attacks within the system if the files contain confidential or proprietary information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR and HIPAA. It may result in data breaches, legal penalties, loss of trust, and potential fines due to non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update opensignserver to a patched version beyond 2.37.0. If an update is unavailable, disable the getsignedurl Parse cloud function or restrict access to it via network rules. Implement strict input validation for docId parameters to ensure only valid document IDs are accepted.

Useful 0 Not Useful 0