| tiêu đề | casdoor commit 0585ecf Missing Authorization |
|---|
| Mô tả | Unauthenticated Arbitrary File Upload via /api/upload-resource
Summary
The POST /api/upload-resource endpoint in Casdoor accepts uploads from completely unauthenticated callers. The Casbin authorization policy whitelists this route for the anonymous principal (p, *, *, POST, /api/upload-resource, *, *), and the controller's helper that resolves the target storage provider (GetProviderFromContext) returns the provider directly when a ?provider= query parameter is supplied, bypassing the RequireSignedIn check that gates the fallback path. Any storage provider configured by an administrator (S3, Aliyun OSS, Local File System, Azure Blob, etc.) becomes a public write destination. The resulting Resource record is registered under the attacker-supplied owner / user / application query parameters, so the upload appears as if it were performed by an arbitrary legitimate user. When the storage provider serves uploaded files back (Local File System provider exposes /files/<path>), the attacker can retrieve the file with no authentication, creating a fully unauthenticated read-after-write primitive against the host.
https://github.com/casdoor/casdoor/ |
|---|
| Nguồn | ⚠️ https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-1-unauthenticated-arbitrary-file-upload-via-apiupload-resource |
|---|
| Người dùng | geochen (UID 78995) |
|---|
| Đệ trình | 08/07/2026 15:52 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 01/09/2026 19:55 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 397791 [Casdoor đến 4.0.0 upload-resource API controllers/resource.go xác thực yếu] |
|---|
| điểm | 20 |
|---|