Description
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| classroomio | classroomio | ≤ 1.0.0 | — |
References
- GitHub Issue #1414 issue-tracking
- https://github.com/classroomio/classroomio product
- https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca patch
- https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration technical-description
- https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612 technical-description
- https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290 technical-description
- VulnCheck Advisory: ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint third-party-advisory