Description

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T13:17:29.007Z",
  "pubdate": "2026-10-12T13:17:29.007Z",
  "executiveSummary": "The lamp-cloud platform, through version 5.10.1, is affected by an Insecure Direct Object Reference (IDOR) vulnerability. This security flaw resides within the attachment retrieval mechanism, enabling an authenticated attacker to bypass authorization controls and access sensitive files belonging to other users.\nBy manipulating specific request parameters, unauthorized parties can retrieve storage URLs for arbitrary file attachments stored within the system. The vulnerability stems from a lack of server-side ownership validation during the file resolution process.\nThe risk implication is significant, as it facilitates unauthorized data exposure and potential information leakage. An attacker requires a valid authentication session to exploit this flaw, but no elevated privileges are necessary. Once exploited, the attacker can systematically iterate through file identifiers to gain unauthorized access to attachments across the platform, compromising the confidentiality of user data.\nImmediate remediation is required to implement robust server-side authorization checks that verify if the requesting user possesses legitimate access rights to the requested file resource before returning any sensitive URLs.",
  "technicalDetails": "The root cause of this vulnerability is a critical failure in the access control logic of the FileAnyoneController. Specifically, the findUrlById function facilitates the retrieval of temporary storage URLs for uploaded attachments without performing a requisite authorization check to ensure the authenticated user owns or has permission to access the requested file identifier.\nThe attack flow follows a predictable pattern: 1) An authenticated attacker identifies a target file ID, potentially via enumeration or intercepted traffic. 2) The attacker crafts a request to the findUrlById endpoint, supplying the target file ID as a parameter. 3) The backend application processes the request, locates the resource associated with the provided ID, and returns the storage URL to the attacker, completely bypassing any ownership verification process.\nThis vulnerability is classified as an IDOR (Insecure Direct Object Reference). Because the application trusts the client-supplied ID without validating session-based ownership, it effectively leaks resource access to any logged-in user, regardless of whether the user is authorized to view the specific attachment.\nThe affected component is the FileAnyoneController, which handles file resolution within lamp-cloud versions up to and including 5.10.1. Exploitation is performed via the network, necessitating an active, authenticated session. The payload behavior is passive; it does not require complex injection or memory manipulation, but rather relies on the logic flaw where the controller assumes the request is legitimate solely based on the user's authentication status rather than their authorization to access the specific resource identifier.\nThe post-exploitation impact is a direct breach of data confidentiality. Once the storage URL is retrieved, the attacker can leverage it to download the associated file, which may contain sensitive business data, personal information, or private documentation. This flaw exposes all uploaded attachments across the platform to any registered user capable of interacting with the vulnerable controller."
}