GHSA-h6cx-gjxx-v25c: Composer/sulu/sulu vulnerability
Impact
A media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.
The media move endpoint resolves its permission check from the collection value in the request rather than from the media's real collection. MediaManager::move() then reassigns the media without re-checking its actual source collection. A user who has edit rights on collection A but no rights on a restricted collection B can move a media that lives in B by naming A in the request. The move succeeds, the media ends up in A, and the user can then view and download content they were never allowed to see.
This only affects installations that use per-collection (object level) permissions to restrict some collections. Exploitation requires an authenticated backend user with edit rights on at least one collection, and knowledge of the target media id.
Patches
Fixed in 2.6.25 and 3.0.8. MediaManager::move() now verifies edit permission on the media's real source collection and on the destination collection before moving it.
Workarounds
If you cannot upgrade immediately:
- Restrict the media edit permission to trusted users, so untrusted users cannot trigger a move. - Apply the fix manually by adding an edit permission check on the media's real source collection (and the destination) inside MediaManager::move().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/sulu/suluto a version that resolves this vulnerability.Fixed in 3.0.8 - Upgrade
Upgrade
composer/sulu/suluto a version that resolves this vulnerability.Fixed in 2.6.25 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.25 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.8 - Configuration
Apply the fix manually by adding an edit permission check on the media's real source collection (and the destination) inside `MediaManager::move()` so the authorization is resolved from the media's actual collection rather than the `collection` value in the request.
MediaManager::move() media move endpoint Permission check source collection = Use media's real source collection and destination collection rather than the request's collection value - Compensating control
Restrict media edit permission to trusted users so untrusted users cannot trigger a move authorization bypass.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only installations that use per-collection, object-level permissions to restrict access to some collections are affected. The issue enables movement of media from a restricted collection into one the attacker can access.
What does an attacker need to exploit it?
The attacker needs an authenticated backend account with edit rights on at least one collection and knowledge of the target media ID. They do not need permission on the collection where the target media actually resides.
Which releases contain the fix?
The issue is fixed in versions 2.6.25 and 3.0.8. The corrected move operation checks edit permission on both the media's real source collection and the destination collection.
What can be done if an upgrade is not immediately possible?
Restrict media edit permission to trusted users. This reduces the number of backend users able to use the affected move endpoint.