Description

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T13:20:38.987Z",
  "pubdate": "2026-08-10T13:20:38.987Z",
  "executiveSummary": "A missing authentication vulnerability exists in OpenSignLabs opensignserver through versions 2.37.0, allowing unauthenticated remote attackers to read arbitrary stored documents. The flaw resides within the fileupload Parse cloud function, which fails to perform any session validation or access control checks prior to processing requests.\nThe primary impact of this vulnerability is the unauthorized disclosure of sensitive stored contract files and documents. An unauthenticated remote attacker can exploit this flaw by interacting directly with the vulnerable cloud function, leveraging the application's internal trust mechanisms to generate valid cryptographic credentials for arbitrary file locations.\nAffected systems include deployments of OpenSignLabs opensignserver up to version 2.37.0 utilizing the Parse server backend. The risk implication is severe, as confidentiality controls protecting critical business documents are entirely bypassed without requiring prior privileges, user interaction, or valid authentication sessions.\nExploitation requirements are minimal, requiring only network reachability to the target opensignserver instance and the ability to invoke the Parse cloud function endpoint. The attacker does not need prior access credentials or pre-existing session tokens to successfully retrieve arbitrary files.",
  "technicalDetails": "The root cause of the vulnerability is the absence of session validation and authentication checks within the fileupload Parse cloud function in OpenSignLabs opensignserver through 2.37.0. The function directly processes incoming requests without verifying whether the caller possesses an active, authorized user session or appropriate permissions to access the requested resource.\nThe vulnerable component is the fileupload Parse cloud function responsible for handling file access and generation of retrieval tokens. This component operates with network exposure in environments running the affected opensignserver versions.\nAuthentication and privilege requirements are entirely absent for the targeted endpoint, allowing unauthenticated remote attackers with network access to interact with the function directly. No prior privileges or valid user accounts are required to initiate the attack flow.\nThe exploitation mechanism relies on the function's internal behavior of minting MASTER_KEY-signed file access tokens for any caller-supplied URL. When an unauthenticated attacker sends a crafted request specifying a target document URL to the fileupload cloud function, the backend automatically generates a cryptographically signed access token using the powerful MASTER_KEY.\nThe attack flow proceeds as follows: First, the remote attacker identifies the network endpoint hosting the Parse cloud functions for opensignserver. Second, the attacker formulates a request to the fileupload cloud function, supplying an arbitrary target document URL or file path as a parameter. Third, the vulnerable function processes the input without performing any session checks or access control validation. Fourth, the function successfully generates and returns a MASTER_KEY-signed file access token for the requested URL. Finally, the attacker uses this cryptographically valid access token to bypass the primary access control mechanism and read the arbitrary stored document.\nThe post-exploitation impact includes the full compromise of document confidentiality. Attackers can systematically harvest stored contracts, sensitive agreements, and proprietary files hosted on the affected opensignserver deployment by repeatedly invoking the vulnerable function with targeted URLs."
}