Missing Authorization in NovelPlus Book Download Endpoint (CVE-2020-NOVELPLUS-09) with PoC

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: CVE-2020-NOVELPLUS-09-Book-Download-Missing-Authorization Vulnerability Type: Missing Authorization Vulnerability Description: simulates eight request-handling methods; is one of them. The endpoint allows a zero-permission session to export the complete file—including every chapter and page. The session starts with zero permissions, while the annotated listing endpoint rejects this same session. The export bypasses all pagination, data scoping, and rate limits, exposing the rest of the administrative endpoints. Scope of Impact Affected Component: The endpoint in within the module Impact: Unauthenticated users can download the complete book file (including all chapters and pages), bypassing pagination, data scoping, and rate limits Trigger Conditions: Invoking the endpoint using a zero-permission session Remediation Add permission checks to the endpoint to ensure only users with the appropriate permissions can access it Implement rate limiting and data scoping controls for export operations Return a status code for zero-permission sessions POC Code `` download` is one of them. A session with zero permission bits therefore exports a complete file -- every chapter and page. A session with zero permission bits therefore exports a complete file -- every chapter and page. The annotated listing endpoint refuses that same session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the unprivileged session -- it carries a permission-omitted on /novel/book/list is expected for the un

Goal Reached Thanks to every supporter — we hit 100%!

Missing Authorization in NovelPlus Book Download Endpoint (CVE-2020-NOVELPLUS-09) with PoC

More from this source