Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moxi624 | MoguBlog | ≤ 6.2 | — |
References
- C04 - POST /web/comment/delete proof of concept exploit
- CommentRestApi.deleteBatch compares the stored author uid against a request-body field technical-description
- mogu_web WebSecurityConfig permits /web/comment/** for all callers technical-description
- MoguBlog releases release-notes
- Product product
- VulnCheck Advisory: MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check third-party-advisory