abraxas/openmeetings-chat-user-idorApache OpenMeetings 9.1.0 - High - Remote - IDOR - dashboard chatTab-u{id} exports another users private chat
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-chat-user-idor
Class: IDOR Reach: Remote
Apache OpenMeetings 9.1.0 (9773c59e). Any ROOM/DASHBOARD session exports another user's private chat by setting activeTab=chatTab-u{id}. ChatToolbar user branch is u -> true. Save/delete buttons are admin-visible only; AjaxDownloadBehavior is registered on the toolbar itself.
| ID | no CVE yet |
| Class | IDOR |
| Reach | Remote (authenticated Wicket dashboard) |
| CWE | CWE-639 |
| CVSS | High: 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| Product | Apache OpenMeetings 9.1.0 |
| Auth | LOGIN + DASHBOARD (default register) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18151 only |
| Method | Sink | Privilege |
|---|---|---|
Wicket chat download activeTab=chatTab-u{victimId} | ChatToolbar user branch u -> true (ChatToolbar.java:87-94, 134-138) | Recon (lab-proven): CSV of DMs. Lab: "Vic User",...,"OPENMEETINGS-CHAT-IDOR-WITNESS". |
Same activeTab delete AjaxButton | chatDao.deleteUser(id) (ChatToolbar.java:208-212) | Integrity (inferred): wipe that inbox. Export was the SUCCESS oracle. |
Closed: global/room export still needs admin or room moderator. Kick/mute-all are not this callback.
cd lab
./run.sh
Last line: SUCCESS OPENMEETINGS-CHAT-IDOR-WITNESS
Suggested fix: user-branch download/delete must be u.getId().equals(getUserId()) or admin. Do not register AjaxDownloadBehavior for hidden admin buttons.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]