| Titel | MingSoft ms-mdiy 3.0.6 Exposure of Access Control List Files to an Unauthorized Control |
|---|
| Beschreibung | **MingSoft MCMS ms-mdiy: Unauthenticated access to custom form submissions via `/mdiy/form/data/list`**
### Description
Apache Shiro only protects `/ms/**`. Routes under **`/mdiy/**` are anonymously accessible**.
The endpoint `GET /mdiy/form/data/list.do` lists all submission records for a form when `isWebSubmit=true`, without any authentication. Exposed fields include `USERNAME`, `TEL`, `CONTENT`, `CREATE_BY`, and others.
This issue shares the same endpoint as VULN-1, but **unauthorized data read alone** is a distinct security impact even without SQL injection.
### Root Cause
1. `ShiroConfig` does not enforce authentication on `/mdiy/**`.
2. `web.FormDataAction#list` only checks `isWebSubmit`; there is no API token, Referer check, IP restriction, or login requirement.
3. The default guestbook form `liuyan` ships with `isWebSubmit=true`, making the issue exploitable out of the box.
### Impact
- Disclosure of user-submitted PII (names, phone numbers, message content, etc.).
- Disclosure of business data and internal metadata (e.g. `CREATE_BY` administrator ID).
- Provides reconnaissance for VULN-1 (table names, column names, record IDs).
### 4.5 CVSS 3.1 Vector (suggested)
```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5 (High)
```
### 4.6 Reproduction Steps and PoC
```http
GET /mdiy/form/data/list.do?modelName=liuyan HTTP/1.1
Host: target:8080
```
**Expected response (excerpt):**
```json
{
"result": true,
"data": {
"rows": [
{
"id": "2069284506314330112",
"USERNAME": "audit_user",
"TEL": "13900001111",
"CONTENT": "hello_audit",
"CREATE_BY": "57"
}
]
}
}
```
No cookie required; reachable from the public network.
### Remediation
1. Disable the front-end list API by default. If public read access is required:
- Return only necessary fields (mask phone numbers, omit `CREATE_BY`, etc.);
- Require a dedicated read-only token or user login;
- Enforce pagination and rate limiting.
2. Change the default value of `isWebSubmit` to `false` and display a clear security warning in the admin UI.
3. Add authentication or request signing to `/mdiy/form/data/list`.
--- |
|---|
| Benutzer | murkfox (UID 15240) |
|---|
| Einreichung | 23.06.2026 07:41 (vor 2 Monaten) |
|---|
| Moderieren | 08.08.2026 20:48 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 387210 [MingSoft MCMS bis 3.0.6 ms-mdiy /mdiy/form/data/list Information Disclosure] |
|---|
| Punkte | 17 |
|---|