| Título | Frappe Frappe LMS 2.40.0 Improper Access Controls |
|---|
| Descripción | Frappe LMS 2.40.0 – Public Access to Instructor Assignment Media
Summary
Frappe LMS version 2.40.0 contains an access control vulnerability where media files uploaded by instructors to assignments are publicly accessible to unauthenticated users. While media uploaded by students to assignments is stored as private, instructor-uploaded media is stored under the /files/ path and can be accessed by anyone who knows or guesses the file URL.
Vulnerability Details
The application applies inconsistent access control to assignment media uploads:
- Student uploads are treated as private.
- Instructor uploads within assignment questions are stored under /files/ and are accessible without authentication.
This allows an unauthenticated attacker to retrieve potentially sensitive teaching material or internal resources by directly requesting the file path or fuzzing filename patterns.
CVSS v3.1 Base Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Steps to Reproduce
1. Log in as an instructor.
- Navigate to the assignments page: http://localhost:8000/lms/assignments
2. Create a new assignment.
- Click the "Create" button in the top-right corner.
- In the assignment creation modal, locate the question text area.
3. Upload media in the question field.
- Use the media upload/browse functionality in the question editor.
- Upload an image or other media file.
- Observe that the file is stored under a URL like: http://localhost:8000/files/faj.png
4. Access the file without authentication.
- Log out of the application (or use a private browser window).
- Directly open the file URL, for example: http://localhost:8000/files/faj.png
- The media is still accessible, despite no active session.
Impact
- Information disclosure: Internal teaching materials, assignment content, hints, or embedded resources uploaded by instructors can be accessed by unauthenticated users.
- Loss of confidentiality: Assignment wording or example material meant only for enrolled students or specific cohorts becomes globally accessible.
- Reconnaissance: An attacker can fuzz or brute-force /files/ to enumerate other private resources uploaded by instructors.
While the impact is primarily on confidentiality, the risk is increased by the lack of authentication for the /files/ endpoint and the predictability of filenames.
|
|---|
| Fuente | ⚠️ https://gist.github.com/0xHamy/4dc7d48e81475f996dba0d194ca07a0d |
|---|
| Usuario | 0xHamy (UID 88518) |
|---|
| Sumisión | 2025-12-02 19:56 (hace 10 meses) |
|---|
| Moderación | 2025-12-10 08:23 (8 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 327014 [Frappe LMS 2.35.0 Assignment Picture /files/ escalada de privilegios] |
|---|
| Puntos | 0 |
|---|