Description

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:30.190Z",
  "pubdate": "2026-10-12T13:17:30.190Z",
  "executiveSummary": "MoguBlog through version 6.2 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within its network disk management functionality.\nThe vulnerability resides in the POST /networkDisk/getFileList endpoint, which fails to enforce proper server-side authorization checks against the requesting user's identity.\nBy manipulating the request parameters, an authenticated administrator can bypass access controls to enumerate and access file metadata and download links belonging to other administrators within the system.\nThe core issue stems from the application's reliance on client-side input for filtering while neglecting to validate that the requested file resources are logically associated with the authenticated administrator's unique identifier (admin_uid).\nThis flaw allows for unauthorized information disclosure of sensitive file structures and contents, potentially leading to a broader compromise of administrative data stored on the network disk.\nExploitation requires active authentication as a valid administrator, after which the attacker can systematically harvest file paths and download URLs without restriction, significantly impacting the confidentiality of administrative assets.",
  "technicalDetails": "The vulnerability is localized within the network disk management module, specifically handling the POST /networkDisk/getFileList API endpoint. The underlying architecture exhibits a critical lack of multi-tenancy or ownership enforcement at the data access layer.\nRoot Cause Analysis: The application logic performs filtering based on user-supplied parameters such as 'status', 'file type', or 'filePath'. However, the query execution layer fails to incorporate the 'admin_uid' of the authenticated session into the database query's WHERE clause. Consequently, the backend retrieves all file records from the database that match the provided filters, regardless of which administrative account owns those files.\nAttack Flow: An authenticated attacker initiates a POST request to /networkDisk/getFileList. By intentionally omitting or manipulating authorization-specific constraints, the attacker forces the application to process a query that retrieves the global set of files managed by the network disk component. The server-side controller blindly trusts the request parameters and returns the full response object, which includes file metadata, internal file naming conventions, and persistent download URLs.\nAuthentication and Privileges: Successful exploitation requires a valid administrative session. While this limits the threat to existing accounts, it constitutes a privilege escalation scenario where an attacker accesses data horizontally across peer administrative accounts.\nPayload Behavior: Attackers can craft requests to iterate through file types or directory paths to build a comprehensive map of the entire network disk repository. Since the API returns direct download URLs, the attacker can leverage these links to exfiltrate private files from other administrators' directories without further interaction.\nAffected Versions: All MoguBlog versions up to and including 6.2 are affected by this logic flaw.\nImpact: The exposure of full download URLs and file metadata allows for unauthorized access to internal assets. In a production environment, this facilitates data exfiltration and may expose sensitive configuration files or personal administrative uploads, potentially leading to further exploitation vectors or data breaches."
}