Description

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP or purchase verification, bypassing the permission checks and data-scope limits enforced elsewhere in the admin interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T14:17:20.553Z",
  "pubdate": "2026-09-14T14:17:20.553Z",
  "executiveSummary": "The novel-plus application, through version 5.3.3, is susceptible to an authorization bypass vulnerability located within the BookController download endpoint.\nThis vulnerability is classified as an improper access control issue, allowing an authenticated backend user to circumvent established business logic concerning content monetization.\nThe flaw stems from the application's failure to validate VIP status or purchase history when processing requests for book content exports.\nBy manipulating the request parameters, an attacker with valid backend credentials can illicitly export the entire text of protected books, including premium or paid chapters.\nThe impact is significant, as it permits unauthorized data extraction, undermines the platform's revenue model, and exposes intellectual property that should remain restricted to authorized users.\nWhile the vulnerability requires an authenticated backend account, it represents a critical failure in the application's authorization framework, as the endpoint lacks the necessary data-scope enforcement typically required for sensitive content retrieval operations.",
  "technicalDetails": "The vulnerability resides in the BookController class, specifically within the endpoint responsible for exporting or downloading book content. The root cause is a failure to perform server-side verification of user permissions and purchase entitlements during the invocation of the content retrieval function.\nUnder normal operating conditions, the novel-plus architecture should enforce a validation check before serving content, ensuring that the authenticated user possesses the appropriate VIP status or a confirmed purchase record for the specific bookId requested.\nIn the vulnerable versions (up to 5.3.3), the BookController fails to validate the current session against these constraints. An attacker possessing valid backend administrative or general account credentials can target the export endpoint by supplying a specific bookId and bookName.\nThe attack flow proceeds as follows: First, the attacker identifies a target bookId through legitimate browsing or enumeration. Second, the attacker constructs a request to the download endpoint within the BookController. Third, by omitting the necessary purchase verification tokens or by directly invoking the backend logic that exports the content stream, the attacker triggers the application to compile the full text of the book.\nThe system subsequently processes this request and returns the entire book content to the requester. Because the endpoint does not check if the content is restricted or if the user is authorized to access premium chapters, the entire textual body is leaked.\nThis bypasses the data-scope limitations that are correctly implemented in other areas of the admin interface, indicating an inconsistency in security policy enforcement across the application's controllers.\nThe lack of integrity and authorization checks at this specific entry point allows for large-scale scraping of protected assets. Since this is an authenticated bypass, the exploitation leaves traces in the application's access logs, but because the action appears as a valid request to the controller, it may not be flagged as malicious by standard perimeter defenses unless granular application-layer monitoring is in place."
}