eladmin Missing Authorization in S3 Storage Download Handler

Executive Summary

This vulnerability is a missing authorization flaw in the eladmin software. It exists in the downloadS3Storage handler where any authenticated user can retrieve stored object URLs without needing storage permissions. Attackers exploit this by sending requests to GET /api/s3Storage/download/{id} and enumerating sequential IDs to collect all uploaded object URLs. If the S3 buckets are publicly readable, this exposes the contents of those files.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the GET /api/s3Storage/download/{id} endpoint by monitoring logs for sequential ID enumeration attempts. Use tools like curl to test the endpoint with different IDs: curl -u username:password http://target/api/s3Storage/download/1. If responses return file URLs without proper authorization, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

If you use eladmin with S3 storage, an attacker with basic authentication could access files they shouldn't. This could lead to data breaches, exposure of sensitive information, or unauthorized file downloads. The impact depends on what data is stored in the S3 buckets.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA. It enables unauthorized access to sensitive data, which could result in data breaches. Organizations using this software may face regulatory penalties, legal consequences, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /api/s3Storage/download/{id} endpoint by implementing proper authorization checks. Ensure only users with storage:list permission can access it. Update the S3StorageController.java to add @PreAuthorize("hasPermission('storage','list')") to the downloadS3Storage method. Verify bucket permissions are not set to public read.

Useful 0 Not Useful 0