GHSA-8j7x-38m5-84xj: LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, PrintRecordStickers in /Controllers/VehicleController.cs checks through CollaboratorFilter that the authenticated caller can view the supplied vehicleId, but fetches caller-supplied recordIds without checking that each record's VehicleId belongs to the authorized vehicle. An authenticated user can submit POST /Vehicle/PrintRecordStickers with an authorized vehicleId, enumerate other users' integer record IDs and select an ImportMode to retrieve records across the service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection and equipment stores. Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. This issue is fixed in version 1.6.8.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LubeLoggerto a version that resolves this vulnerability.Fixed in 1.6.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can view at least one vehicle can exploit the issue. They need to submit a request using a vehicle ID they are authorized to access and record IDs belonging to other users.
What information could be exposed?
The affected endpoint can return records from service, gas, repair, upgrade, tax, supply, note, odometer, reminder, plan, inspection, and equipment stores. Exposed data can include descriptions, costs, notes, mileage, extra fields, and file attachment metadata.
What versions need remediation?
Versions prior to 1.6.8 are affected. The issue is fixed in version 1.6.8.