Description
Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve provisioned usernames, emails, names, externalIds, and group memberships.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| padloc | padloc | < 4.3.1 | 4.3.1 |
References
- GitHub Issue #795 issue-tracking
- https://github.com/padloc/padloc product
- Fix commit patch
- https://github.com/padloc/padloc/blob/v4.3.0/packages/server/src/scim.ts#L702-L714 technical-description
- VulnCheck Advisory: Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests third-party-advisory