Authorization Bypass in lamp-cloud via deleteMyNotice Endpoint

Executive Summary

lamp-cloud through version 5.10.0 has an authorization bypass flaw in the deleteMyNotice endpoint. Authenticated users can exploit this by calling DELETE /anyone/extendNotice/deleteMyNotice with arbitrary notice IDs to permanently delete other users' notifications without proper validation of recipient permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to the /anyone/extendNotice/deleteMyNotice endpoint. Check for requests with arbitrary notice IDs sent by authenticated users. Inspect server logs for unusual deletion patterns or unauthorized access attempts targeting notifications.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with valid credentials to delete important notifications belonging to other users. This could lead to loss of critical alerts, missed updates, or disruption of services that rely on those notifications for proper functioning.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by potentially causing unauthorized data deletion or loss of audit trails if notifications contain sensitive information. GDPR requires data integrity and accountability, while HIPAA mandates secure handling of health information. Unauthorized deletion may violate these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update lamp-cloud to the latest version beyond 5.10.0. Implement strict input validation for notice IDs in the deleteMyNotice endpoint. Restrict DELETE request permissions to authorized users only. Review and audit all recent notification deletions for signs of exploitation.

Useful 0 Not Useful 0