Summary
The raw asset download endpoint GET /api/raw/assets/{path} authenticates the caller but never checks that the requested file belongs to them. Because every user's files are stored under a predictable directory name, any authenticated user (the default non-kiosk "viewer" role is enough) can read every other user's uploaded assets: profile avatars, game saves, save states, and screenshots.
Details
[REDACTED]
PoC
[REDACTED]
Impact
CWE-639 (Authorization Bypass Through User-Controlled Key) / broken object-level authorization. In any multi-user RomM instance, one low-privileged account can exfiltrate every other user's private uploaded assets (avatars, saves, save states, screenshots) over authenticated HTTP, with no admin rights and no brute force (paths are deterministic). Screenshots and saves may contain personal content; this breaks isolation between users.
benanaisgood Reporter
gantoine Remediation developer
Summary
The raw asset download endpoint
GET /api/raw/assets/{path}authenticates the caller but never checks that the requested file belongs to them. Because every user's files are stored under a predictable directory name, any authenticated user (the default non-kiosk "viewer" role is enough) can read every other user's uploaded assets: profile avatars, game saves, save states, and screenshots.Details
[REDACTED]
PoC
[REDACTED]
Impact
CWE-639 (Authorization Bypass Through User-Controlled Key) / broken object-level authorization. In any multi-user RomM instance, one low-privileged account can exfiltrate every other user's private uploaded assets (avatars, saves, save states, screenshots) over authenticated HTTP, with no admin rights and no brute force (paths are deterministic). Screenshots and saves may contain personal content; this breaks isolation between users.