Description
EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding an attachment object key can omit or supply an invalid token to retrieve plaintext attachments without a session or channel membership.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aozorae | EdgeChat | < 2.20.3 | 2.20.3 |
References
- https://github.com/aozorae/Edgechat/issues/58 issue-tracking
- https://github.com/aozorae/Edgechat/commit/38cb5cf42d8014ca64624d4f4d565419b2fbeda9 patch
- https://github.com/aozorae/Edgechat/blob/1288c66997d5e2f9eefc515cf60b2072f8d655be/worker/src/data/uploaded-files.js#L146 technical-description
- https://hackmd.io/@hieund/edgechat-files-unauthenticated-public-attachment-disclosure technical-description
- VulnCheck Advisory: EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key third-party-advisory