Unauthenticated File Download in Yii2 Starter Kit

Executive Summary

This vulnerability in yii2-starter-kit through version 4.2.0 allows unauthenticated attackers to download files from draft articles by exploiting an unprotected attachment-download endpoint. The system fails to check if an article is published before allowing file access, enabling sequential attachment ID guessing to retrieve unpublished files without authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if your yii2-starter-kit version is 4.2.0 or below by inspecting the composer.lock file or running composer show yii2-starter-kit. Look for unauthorized file downloads by monitoring access logs for the attachment-download endpoint and checking for sequential attachment ID requests.

Useful 0 Not Useful 0

Impact Analysis

Attackers could access sensitive files from unpublished articles, including drafts, internal documents, or confidential attachments. This may lead to data leaks, intellectual property theft, or compliance violations depending on the exposed content.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing personal data in draft articles or HIPAA by leaking protected health information. Unauthorized access to sensitive data may result in regulatory fines, legal liabilities, and reputational damage due to non-compliance with data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade yii2-starter-kit to a version higher than 4.2.0 immediately. If upgrading is not possible, implement strict validation in the attachment-download endpoint to verify article publication status and restrict file access to authorized users only.

Useful 0 Not Useful 0