Description
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LiuYuYang01 | ThriveX-Server | ≤ 4.0 | — |
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/thrivex-server-draft-article-unauth-disclosure third-party-advisory
- https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L228-L270 technical-description
- https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/service/impl/ArticleServiceImpl.java#L318-L356 technical-description
- https://github.com/LiuYuYang01/ThriveX-Server/blob/4.0/blog/src/main/java/liuyuyang/net/web/controller/ArticleController.java#L82-L102 technical-description
- ThriveX-Server 4.0 Release Notes release-notes
- VulnCheck Advisory: ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints third-party-advisory