Missing Authorization in Shaark API Controllers

Executive Summary

Shaark versions 1.2.13 through 1.2.44 have a missing authorization flaw in Link, Story, Chest and Album API controllers. This allows authenticated non-admin users to bypass ownership checks by sending PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs. This can lead to overwriting or deleting other users' content, including private items.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs. Check for non-admin users performing actions on other users' content. Use network traffic analysis tools to inspect requests for unauthorized modifications or deletions.

Useful 0 Not Useful 0

Impact Analysis

If you are a non-admin user of Shaark, an attacker could exploit this to modify or delete your content without permission. If you are an admin, attackers could still target other users' private data, leading to data loss or unauthorized changes. The impact includes potential loss of sensitive information and disruption of service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or deletion of personal data, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information (PHI) without authorization. Compliance failures may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Shaark to a version beyond 1.2.44. Implement strict ownership validation in API controllers to prevent non-admin users from accessing or modifying others' content. Restrict PUT and DELETE requests to authenticated admin users only.

Useful 0 Not Useful 0