Description
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSignLabs | OpenSign | ≤ 2.41.3 | — |
References
- GitHub Issue #2218 issue-tracking
- https://github.com/OpenSignLabs/OpenSign product
- the lookup runs with useMasterKey and returns the document when IsEnableOTP is false technical-description
- VulnCheck Advisory: OpenSign through 2.41.3 Information Disclosure via getDocument third-party-advisory