Description
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| haiwen | seahub | < 13.0.23 | 13.0.23 |
References
- Release Notes release-notes
- GitHub Issue issue-tracking
- Patch Commit (1) patch
- Patch Commit (2) patch
- https://www.vulncheck.com/advisories/seahub-authentication-bypass-in-sharelinkziptaskview-get-method third-party-advisory