Description

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T13:17:29.350Z",
  "pubdate": "2026-10-12T13:17:29.350Z",
  "executiveSummary": "The lamp-cloud platform, specifically versions through 5.10.1, is affected by an Insecure Direct Object Reference (IDOR) vulnerability.\nThis flaw resides within the listFileByBizId endpoint, which lacks sufficient authorization controls when processing business object identifiers (bizId).\nAn authenticated attacker can exploit this vulnerability to enumerate and retrieve sensitive metadata associated with file attachments belonging to other users or tenants.\nExposed data includes original file names, internal storage paths, MD5 file hashes, and direct access URLs.\nIn configurations utilizing LOCAL storage, these file resources are served via the /anyTenant/file path without requiring authentication, effectively bypassing access controls and potentially exposing private data globally.\nThe risk is significant as it facilitates unauthorized information disclosure, allowing attackers to map sensitive infrastructure, harvest private documents, and potentially leverage MD5 hashes for further cryptographic or forensic analysis.\nExploitation requires a valid user session but does not necessitate administrative privileges, making it a critical concern for multi-tenant environments.",
  "technicalDetails": "The root cause of the vulnerability is an inadequate implementation of authorization checks within the business logic layer responsible for the listFileByBizId endpoint. The application fails to validate that the authenticated user maintains the necessary permissions or ownership over the requested bizId before returning the associated file metadata.\nThe exploitation flow begins when an authenticated attacker submits a crafted HTTP request to the listFileByBizId endpoint. By iterating through or guessing arbitrary bizId values, the attacker can force the application to return detailed object records stored in the database.\nUpon successful invocation, the application returns a JSON payload containing sensitive fields. For each file, the API exposes the file name, the absolute or relative storage path on the server, the MD5 checksum, and the full URI required to retrieve the asset.\nA critical secondary security failure exists in the LOCAL storage implementation. Files stored locally are exposed via the /anyTenant/file endpoint, which functions as an open directory or public access point that does not verify user authentication tokens or session state. Consequently, once an attacker acquires the URL or path via the initial IDOR exploit, they can download the actual file content without further interaction with the main application layer.\nThe vulnerability affects lamp-cloud versions through 5.10.1. The attack surface is accessible via the network to any authenticated user, regardless of their specific role or tenant assignment, assuming the business logic does not strictly enforce boundary checks at the object level.\nPost-exploitation, an attacker can systematically harvest the entire library of attachments across the platform. Given that file names and paths are exposed, this can lead to the discovery of sensitive business documentation, configuration files, or PII. Furthermore, the exposure of MD5 hashes provides a mechanism for the attacker to verify file integrity or attempt to link files to known malicious or sensitive entities discovered elsewhere. The lack of tenant isolation for LOCAL storage ensures that data from one tenant is fully accessible to another, violating the core security requirements of a multi-tenant cloud-native architecture."
}