Description
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| blossom-editor | Blossom | ≤ 1.17.1 | — |
References
- https://github.com/blossom-editor/blossom/issues/214 issue-tracking
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232 technical-description
- https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109 technical-description
- https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete third-party-advisory
- https://github.com/blossom-editor/blossom product
- VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints third-party-advisory