| Título | projeto-siga siga 11.0.2.10 through 11.1.1 authorization bypass |
|---|
| Descrição | A vulnerability was identified in projeto-siga SIGA in the public document authentication flow at POST /sigaex/public/app/autenticar and GET /sigaex/public/app/arquivoAutenticado_stream.
In ExAutenticacaoController.autenticar(), the normal external-visibility rule is evaluated without the supplied cod parameter. The request is rejected only when cod is null or empty and the document is not externally visible. Therefore any non-empty invalid cod reaches buildJwtToken(n), producing a server-signed JWT before the real external-access token is validated.
arquivoAutenticado() later calls the four-argument ExPodeVisualizarExternamente(..., cod), but this check only controls presentation. The response already contains the JWT in stream and signature URLs. arquivoAutenticado_stream() verifies only the JWT signature and n claim, obtains the document, and returns PDF bytes. It does not receive cod and does not repeat ExPodeVisualizarExternamente or document-level authorization.
PoC on an isolated instance with a restricted test document:
POST /sigaex/public/app/autenticar
Content-Type: application/x-www-form-urlencoded
n=TEST_DOCUMENT_REFERENCE&cod=DELIBERATELY-INVALID-CODE&g-recaptcha-response=VALID_TEST_RESPONSE
Extract the eyJ... JWT from the returned stream/signature URLs, then:
GET /sigaex/public/app/arquivoAutenticado_stream?jwt=JWT_FROM_FIRST_RESPONSE&assinado=false
The stream endpoint returns the restricted document without receiving or validating the required external-access code.
Affected files:
sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java
siga-ex/src/main/java/br/gov/jfrj/siga/ex/logic/ExPodeVisualizarExternamente.java
Affected parameters: cod, jwt
Impact: unauthenticated disclosure of restricted document PDF and related metadata to anyone who knows or obtains the document authentication/reference number.
Confirmed affected: v11.0.2.10, v11.0.2.13, v11.1.1 and develop at c65f287e84f1a0626c79310da0245bc8abb3175c. No patched version known.
CWE-862, CWE-287.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
Recommendation: validate cod before issuing JWT, bind explicit authorization to the JWT, and repeat document-level authorization inside arquivoAutenticado_stream.
Vendor notified publicly at https://github.com/projeto-siga/siga/issues/2493. Product source: https://github.com/projeto-siga/siga. |
|---|
| Fonte | ⚠️ https://github.com/projeto-siga/siga/issues/2493 |
|---|
| Utilizador | volksec (UID 93050) |
|---|
| Submissão | 25/07/2026 05h59 (há 1 mês) |
|---|
| Moderação | 06/09/2026 15h16 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 399435 [projeto-siga até 11.0.2.10/11.0.2.13/11.1.1 Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar cod/jwt Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|