PATCH /api/v3/work_packages/{id} accepts a writable _links.fileLinks payload property. The update path is missing the user_allowed_to_manage_file_links validation that exists on the create path, and the underlying setter resolves Storages::FileLink records by raw id with no scope. An authenticated user with only edit_work_packages (no manage_file_links, no membership in the victim project) can therefore:
-
detach (and, via dependent: :delete_all, hard-delete) every FileLink currently attached to a work package they can edit, and
-
re-parent any FileLink in the database, identified by its numeric id, onto an attacker-controlled work package, gaining read access to its metadata (origin filename, origin id, mime type) and removing it from the victim's work package.
Credits
This vulnerability was reported as part of the YesWeHack.com OpenProject Bug Bounty program, sponsored by the European Commission.
PATCH /api/v3/work_packages/{id}accepts a writable_links.fileLinkspayload property. The update path is missing theuser_allowed_to_manage_file_linksvalidation that exists on the create path, and the underlying setter resolvesStorages::FileLinkrecords by raw id with no scope. An authenticated user with onlyedit_work_packages(nomanage_file_links, no membership in the victim project) can therefore:detach (and, via
dependent: :delete_all, hard-delete) every FileLink currently attached to a work package they can edit, andre-parent any FileLink in the database, identified by its numeric id, onto an attacker-controlled work package, gaining read access to its metadata (origin filename, origin id, mime type) and removing it from the victim's work package.
Credits
This vulnerability was reported as part of the YesWeHack.com OpenProject Bug Bounty program, sponsored by the European Commission.