Description
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or /api/documents/save-blueprint to read private documents and overwrite presentation blueprints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| himovo | MOVO | 0.1.0 – ≤ 0.2.3 | — |
References
- MOVO document endpoints do not enforce object ownership technical-description exploit
- fetch_document() at v0.2.3 technical-description
- save_blueprint() at v0.2.3 technical-description
- https://github.com/himovo/movo product
- VulnCheck Advisory: MOVO through 0.2.3 Authorization Bypass via Document Endpoints third-party-advisory