GHSA-m48r-jv24-jjcx: LORIS has incorrect access checks in API for Imaging Browser
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the API for the imagingbrowser module permits edits to imaging data without checking the frontend permissions that restrict editing in Imaging Browser. An authenticated API caller can therefore modify imaging data without the required edit authorization. Deployments that no longer use the API can disable it to remove access to this endpoint. This issue is fixed in versions 27.0.4 and 28.0.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LORISto a version that resolves this vulnerability.Fixed in 27.0.4 - Upgrade
Upgrade
LORISto a version that resolves this vulnerability.Fixed in 28.0.2 - Configuration
Disable the API in deployments that no longer use it to remove access to the affected endpoint.
LORIS API API enabled = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated caller that can access the imaging_browser API can exploit it. The caller does not need the frontend edit permission that Imaging Browser normally requires.
Are default permissions sufficient to prevent unauthorized edits?
No. The affected API does not enforce the frontend permissions that restrict editing in Imaging Browser, so API access can bypass those edit restrictions.
What can be done if upgrading is not immediately possible?
If the deployment no longer uses the API, disable it to remove access to the affected endpoint. Otherwise, restrict API access to authenticated users who should be allowed to modify imaging data.
Which releases contain the fix?
The issue is fixed in LORIS 27.0.4 and 28.0.2. Affected release ranges are 22.0.0 through versions before 27.0.4, and 28.0.0 through versions before 28.0.2.