Description

A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-11-06T16:17:54.987Z",
  "pubdate": "2026-11-06T16:17:54.987Z",
  "executiveSummary": "A critical improper authorization vulnerability exists in the xxyopen/201206030 novel application, affecting versions up to 3.5.0.\nThe vulnerability resides within the Book Content Service, specifically in the BookServiceImpl.getBookContentAbout function.\nBy manipulating the chapterId argument, an unauthenticated or unauthorized remote attacker can bypass access control mechanisms to retrieve protected or restricted book content.\nThis flaw poses a significant risk to data confidentiality, as it permits unauthorized access to sensitive or premium content without proper verification of user permissions.\nThe attack is remotely exploitable, requiring no specialized access beyond network connectivity to the vulnerable endpoint.\nPublic disclosure of the exploit increases the likelihood of active exploitation, necessitating immediate remediation via the provided patch.",
  "technicalDetails": "The vulnerability is identified as an Improper Authorization flaw originating from the insecure handling of the chapterId parameter within the BookServiceImpl.getBookContentAbout method, located at src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java.\nThe root cause of this vulnerability is the application's failure to enforce strict access control checks on the provided chapterId argument before processing the request to serve book content. In the vulnerable code, the service retrieves and returns book content based solely on the chapterId without verifying if the requesting user possesses the necessary authorization, subscription status, or legal access rights to view the requested chapter.\nThe attack flow begins with a remote attacker identifying the endpoint associated with the Book Content Service. The attacker sends a crafted request, often via HTTP GET or POST, incorporating a specific chapterId identifier. Because the service does not perform server-side authorization validation, the application processes the input as a trusted request.\nUpon receiving the malicious input, the BookServiceImpl.getBookContentAbout function retrieves the content from the underlying database or file system associated with the provided chapterId. The application then returns the sensitive content in the response body. An attacker can iterate through different chapter IDs to scrape or harvest large volumes of content, effectively bypassing the intended monetization or access restrictions.\nThis vulnerability is classified as remote because the service is exposed to the network, and the lack of authorization checks implies that even users without valid sessions or sufficient privileges can trigger the logic. The post-exploitation impact includes the unauthorized leakage of intellectual property, circumvention of content protection mechanisms, and potential loss of revenue for the content platform.\nThe vulnerability is present in versions up to 3.5.0. Successful exploitation does not require advanced technical skill, as the parameter manipulation is straightforward and the vulnerability logic is exposed at the service level. The issue is addressed by the patch identifier 966c4bdde3521dc0a165d15a2acff66ee33eaaa7, which presumably introduces mandatory permission checks or context-aware authorization logic before content retrieval occurs."
}