Listen to this Post
Cloudreve admin API exposes OAuth scopes.
Admin.Read should inspect only.
Admin.Write should mutate state.
In routers/router.go admin group baseline is ScopeAdminRead.
Most tool write endpoints add RequiredScopes(types.ScopeAdminWrite).
Examples are thumbExecutable and entityUrlCache.
But tool.GET(‘wopi’) lacks Admin.Write.
Also tool.POST(‘mail’) lacks Admin.Write.
GET /wopi fetches or probes WOPI connectivity.
POST /mail sends outbound email.
A token with only Admin.Read can call both.
This breaks OAuth scope separation.
The scope contract says Read cannot write.
The route wiring inconsistency causes bypass.
Line 925 defines tool.GET(‘wopi’).
Line 933 defines tool.POST(‘mail’).
Line 929 has thumbExecutable with Admin.Write.
Line 937 has entityUrlCache with Admin.Write.
The vulnerable endpoints sit between protected ones.
Code review can miss the missing middleware.
OAuth applications with Admin.Read are issued.
Monitoring integrations may receive Admin.Read.
Third-party plugins may receive Admin.Read.
Compromised token gains extra capabilities.
Attacker can send arbitrary SMTP emails.
Attacker can probe internal WOPI endpoints.
Both actions require elevated write authorization.
Expected 403 Forbidden without Admin.Write.
Actual 200 OK and email is sent.
Fix adds RequiredScopes(types.ScopeAdminWrite).
No logic changes are needed.
It is additive middleware insertion.
Apply for CVE when publishing.
This is the Cloudreve privilege scope bypass.
DailyCVE Form:
Platform: Cloudreve
Version: Unspecified
Vulnerability :OAuth scope bypass
Severity: Unspecified
date: Unspecified
Prediction: Expected patch pending
(end of form)
What Undercode Say:
Analytics:
grep -n "ScopeAdminRead|ScopeAdminWrite|tool.GET('wopi')|tool.POST('mail')" routers/router.go
tool.GET('wopi')
tool.POST('mail')
tool.POST('thumbExecutable')
tool.DELETE('entityUrlCache')
middleware.RequiredScopes(types.ScopeAdminWrite)
curl -s -X POST -H 'Content-Type: application/json' \
-H 'Authorization: Bearer <ADMIN_READ_ONLY_TOKEN>' \
'https://cloudreve.example.com/api/v4/admin/tool/mail' \
-d '{"settings":{"smtpHost":"smtp.gmail.com","smtpPort":"587",...},"to":"[email protected]"}'
Exploit: (Educational Purposes!)
curl -s -X POST -H 'Content-Type: application/json' \
-H 'Authorization: Bearer <ADMIN_READ_ONLY_TOKEN>' \
'https://cloudreve.example.com/api/v4/admin/tool/mail' \
-d '{"settings":{"smtpHost":"smtp.gmail.com","smtpPort":"587",...},"to":"[email protected]"}'
Protection: from this CVE
tool.GET('wopi', middleware.RequiredScopes(types.ScopeAdminWrite))
tool.POST('mail', middleware.RequiredScopes(types.ScopeAdminWrite))
Impact:
An OAuth application or API key scoped to Admin.Read can send arbitrary emails through the server’s configured SMTP account and probe internal WOPI service endpoints — both actions that should require elevated write authorization. In multi-party deployments where Admin.Read tokens are issued more liberally (e.g., to monitoring integrations or third-party plugins), a compromised or malicious token holder gains capabilities well beyond what the scope contract implies. Scope separation in OAuth 2.0 is a security boundary, not just a convention, and its violation here could factor into broader attack chains.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
