Listen to this Post
The vulnerability exists in multiple API endpoints designed for user file access. These endpoints use a Universally Unique Identifier (UUID) to locate and serve specific file resources. However, the authorization check is incomplete or missing. The system retrieves the file object based solely on the provided UUID from the database without subsequently verifying that the currently authenticated user has the necessary permissions to access that specific file. This flaw allows any authenticated user, upon discovering or guessing a valid file UUID belonging to another user, to construct a direct API request. The request will bypass intended access controls because the endpoint only validates the UUID’s existence, not the user’s association with it, leading to unauthorized disclosure of sensitive files. The UUIDs, while not sequential, could be discovered through other information leaks or application behavior.
DailyCVE Form:
Platform: pretix
Version: >=2025.10.0 <2025.10.1
Vulnerability: Broken Access Control
Severity: Low
Date: 2024-12-19
Prediction: 2024-12-20
What Undercode Say:
curl -H "Authorization: Bearer <TOKEN>" https://target/api/v1/files/<UUID>
import requests
for uuid in discovered_uuids:
response = requests.get(f'https://target/api/v1/uploaded_files/{uuid}/', headers={'Authorization': 'Bearer <TOKEN>'})
if response.status_code == 200:
print(f"Accessed: {uuid}")
How Exploit:
1. Attacker obtains authentication.
- Attacker discovers or guesses a target file UUID (e.g., via other API responses, logs, or predictable generation).
- Attacker directly calls the vulnerable endpoint (e.g.,
/api/v1/uploaded_files/<UUID>/) with the stolen UUID.
4. Server returns the file without ownership validation.
Protection from this CVE:
Apply provided patches.
Implement proper authorization.
Add user-ownership checks.
Impact:
Cross-user file disclosure.
Sensitive data exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
