| Title | projeto-siga siga 11.0.2.10 through 11.1.1 authorization bypass |
|---|
| Description | A vulnerability was identified in projeto-siga SIGA in the public document authentication flow at POST /sigaex/public/app/autenticar and GET /sigaex/public/app/arquivoAutenticado_stream.
In ExAutenticacaoController.autenticar(), the normal external-visibility rule is evaluated without the supplied cod parameter. The request is rejected only when cod is null or empty and the document is not externally visible. Therefore any non-empty invalid cod reaches buildJwtToken(n), producing a server-signed JWT before the real external-access token is validated.
arquivoAutenticado() later calls the four-argument ExPodeVisualizarExternamente(..., cod), but this check only controls presentation. The response already contains the JWT in stream and signature URLs. arquivoAutenticado_stream() verifies only the JWT signature and n claim, obtains the document, and returns PDF bytes. It does not receive cod and does not repeat ExPodeVisualizarExternamente or document-level authorization.
PoC on an isolated instance with a restricted test document:
POST /sigaex/public/app/autenticar
Content-Type: application/x-www-form-urlencoded
n=TEST_DOCUMENT_REFERENCE&cod=DELIBERATELY-INVALID-CODE&g-recaptcha-response=VALID_TEST_RESPONSE
Extract the eyJ... JWT from the returned stream/signature URLs, then:
GET /sigaex/public/app/arquivoAutenticado_stream?jwt=JWT_FROM_FIRST_RESPONSE&assinado=false
The stream endpoint returns the restricted document without receiving or validating the required external-access code.
Affected files:
sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java
siga-ex/src/main/java/br/gov/jfrj/siga/ex/logic/ExPodeVisualizarExternamente.java
Affected parameters: cod, jwt
Impact: unauthenticated disclosure of restricted document PDF and related metadata to anyone who knows or obtains the document authentication/reference number.
Confirmed affected: v11.0.2.10, v11.0.2.13, v11.1.1 and develop at c65f287e84f1a0626c79310da0245bc8abb3175c. No patched version known.
CWE-862, CWE-287.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
Recommendation: validate cod before issuing JWT, bind explicit authorization to the JWT, and repeat document-level authorization inside arquivoAutenticado_stream.
Vendor notified publicly at https://github.com/projeto-siga/siga/issues/2493. Product source: https://github.com/projeto-siga/siga. |
|---|
| Source | ⚠️ https://github.com/projeto-siga/siga/issues/2493 |
|---|
| User | volksec (UID 93050) |
|---|
| Submission | 07/25/2026 05:59 (1 month ago) |
|---|
| Moderation | 09/06/2026 15:16 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 399435 [projeto-siga up to 11.0.2.10/11.0.2.13/11.1.1 Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar cod/jwt authorization] |
|---|
| Points | 20 |
|---|