Description
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LogicalDOC | LogicalDOC Community Edition | ≤ 9.3 | — |
References
- https://github.com/logicaldoc/community/discussions/119 technical-description
- Patch Commit patch
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/ExportZip.java#L57 technical-description
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/transfer/ZipExport.java#L233 technical-description
- https://github.com/logicaldoc/community product
- VulnCheck Advisory: LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet third-party-advisory