Authorization Bypass in novel-plus BookController Export

Executive Summary

This vulnerability is an authorization bypass in the novel-plus application through version 5.3.3. The BookController download endpoint lacks proper permission checks, allowing authenticated backend users to export complete book text including paid chapters without verification. Attackers can supply a bookId and bookName to retrieve all content bypassing existing purchase checks and data-scope limits enforced elsewhere in the admin interface.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the BookController download endpoint in novel-plus versions up to 5.3.3 lacks proper authorization. Test by sending a request to /novel/book/download with a bookId and bookName. If the endpoint returns full book content without proper permission checks, the vulnerability exists. Use tools like curl or Postman to send authenticated requests and verify if paid chapters are accessible without VIP or purchase verification.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users with backend access to download entire books including paid content without payment or VIP status. It bypasses permission controls and data-scope restrictions, potentially exposing sensitive or copyrighted material. The exploit can be performed with low privileges or even unauthenticated requests in some cases.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and potential exposure of sensitive data, violating privacy requirements under GDPR and HIPAA. It undermines data access controls and may result in non-compliance with data protection regulations requiring strict access controls and audit trails for sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update novel-plus to a version beyond 5.3.3 where the authorization bypass is fixed. If an update is not available, add the @RequiresPermissions annotation to the BookController download method to enforce proper permission checks. Ensure the endpoint validates user roles and paid content access before allowing downloads. Temporarily disable the download feature if a patch is not feasible.

Useful 0 Not Useful 0