Information Disclosure in novel-plus via Unauthenticated API Endpoint

Executive Summary

This vulnerability is an information disclosure flaw in the novel-plus application through version 5.3.3. It affects the /sys/user/list endpoint which lacks proper permission checks. Authenticated attackers can access this endpoint to retrieve sensitive user data including password hashes and personal information like email addresses and phone numbers within their data scope.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the /sys/user/list endpoint is accessible without proper authorization. Use tools like curl to send a GET request to the endpoint with a valid session token. If the endpoint returns user data including password hashes and personal information, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to obtain password hashes and personal data of users in their scope. The password hashes are stored as MD5(MD5(salt + password)) with a fixed salt, making them vulnerable to offline cracking attempts. This could lead to account takeover if weak passwords are used. Attackers need only low-privilege access and must share a department with target users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for protecting personal data and implementing proper access controls. It results in unauthorized disclosure of sensitive personal information including email addresses, phone numbers, and password hashes, which constitutes a data breach under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update novel-plus to a version beyond 5.3.3. Ensure the @RequiresPermissions annotation is added to the SysUserController.list method. Remove the password column from the /sys/user/list endpoint response or mark it with @JsonIgnore. Restrict access to the endpoint based on user roles and permissions.

Useful 0 Not Useful 0