Access Control Flaw in GROWI Exposes Attachment Metadata

Executive Summary

GROWI has an access control flaw in the GET /_api/v3/attachment/:id endpoint. It does not check if a user has permission to view a page before allowing access to attachment metadata. Authenticated attackers can exploit this by using known attachment IDs to retrieve metadata from pages they are not authorized to access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized requests to the GET /_api/v3/attachment/:id endpoint. Check server logs for repeated access attempts to attachment IDs from users without proper page permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gather sensitive information about restricted pages by accessing attachment metadata. This may include filenames, sizes, or other details that reveal the existence or nature of confidential content, leading to potential data leaks or further exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and protection of sensitive data. GDPR and HIPAA both require safeguards to prevent unauthorized access to personal or health information. Failure to address this flaw may result in non-compliance and associated penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GROWI to the latest patched version. Restrict access to the /_api/v3/attachment/:id endpoint by implementing proper permission checks. Review and audit attachment access logs for suspicious activity.

Useful 0 Not Useful 0