Authorization Bypass in O2OA Allows Unauthorized Attachment Download

Executive Summary

This vulnerability is an authorization bypass in O2OA through version 10.0.2-ce. It allows authenticated users to download attachments from other works by exploiting endpoints that do not verify if an attachment belongs to the referenced work or draft. Attackers can use a known attachment UUID to access documents attached to other users' processes through the endpoint jaxrs/attachment/download/{id}/work/{workId}.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check O2OA logs for unauthorized attachment download attempts via the endpoint jaxrs/attachment/download/{id}/work/{workId}. Look for requests where the attachment ID does not belong to the referenced work or draft. Use network monitoring tools to inspect traffic to this endpoint for suspicious patterns.

Useful 0 Not Useful 0

Impact Analysis

If you use O2OA, an attacker with access to your system could read sensitive documents attached to other users' processes, such as contracts or HR files. This could lead to data leaks, unauthorized access to confidential information, and potential misuse of business data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using O2OA may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update O2OA to a patched version if available. If not, restrict access to the jaxrs/attachment/download/{id}/work/{workId} endpoint via firewall rules. Ensure all users follow least-privilege principles and audit existing attachments for unauthorized access.

Useful 0 Not Useful 0