GHSA-fgwh-2pc5-wr73: Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Zipline user can exploit it by providing the ID of another user's folder to the affected PATCH or DELETE endpoint. No additional privileges or user interaction are required.
What actions can an attacker perform on another user's folder?
An attacker can rename the folder, make it public, enable uploads, or delete it. The vulnerability affects the folder PATCH and DELETE handlers at /api/user/folders/:id.
Which deployments are affected?
Diced Zipline versions before 4.5.0 are affected. Because exploitation requires an authenticated account, deployments that allow users to authenticate are exposed to malicious users with valid credentials.