Travel App File Upload Broken Access Control Leaking User Trip Titles

Vulnerability Overview This vulnerability stems from improper validation of the relationship between uploaded files and the 'trip' (travel itinerary) to which the current user belongs during file upload and linking processes. Attackers can exploit this by uploading files and linking them to bookings, locations, or assignments within another user's trip, thereby leaking the trip titles of other users. Scope of Impact File Upload: Attackers can upload files and link them to bookings, locations, or assignments within another user's trip. File Linking: Attackers can link files to bookings, locations, or assignments within another user's trip. File Update: Attackers can update files and link them to bookings, locations, or assignments within another user's trip. Remediation 1. Validation during File Upload: Ensure that when a file is uploaded, it can only be linked to bookings, locations, or assignments belonging to trips owned by the current user. 2. Validation during File Linking: Ensure that when linking a file, it can only be linked to bookings, locations, or assignments belonging to trips owned by the current user. 3. Validation during File Update: Ensure that when a file is updated, it can only be linked to bookings, locations, or assignments belonging to trips owned by the current user. POC Code ```typescript // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts export function findForeignLinkTarget(tripId: string, opts: Parameters[1]) { return svc.findForeignLinkTarget(tripId, opts); } // server/src/services/fileService.ts

Goal Reached Thanks to every supporter — we hit 100%!

Travel App File Upload Broken Access Control Leaking User Trip Titles

More from this source