Unauthenticated Users Can Access Other Users’ Bug Report Attachments via Broken Access Control

How it was found

The /BugReport/Admin/Attachment/{id} endpoint exposes attachments linked to private bug reports. By manipulating the numeric ID in the URL, it’s possible to access attachments belonging to other users, including sensitive bug reports, without proper authorization checks.

This vulnerability works even when unauthenticated, meaning anyone who knows or guesses valid IDs can retrieve attachments. This is a classic Insecure Direct Object Reference (IDOR), where the application fails to enforce access control on a direct object reference (the ID).

References

• OWASP Top Ten 2021 – A01:2021 Broken Access Control
• CWE-639: Authorization Bypass Through User-Controlled Key
• OWASP IDOR Prevention Cheat Sheet

Impact

This vulnerability allows an attacker to access attachments from private bug reports submitted by other users by simply manipulating the ID parameter in the request. Since the endpoint lacks proper authorization checks and even responds when unauthenticated, sensitive internal information, such as unpatched security issues, confidential business data, or personally identifiable information, could be fully exposed. This significantly increases the risk of targeted attacks, information leaks, and reputational damage to the organization.

System Host(s)

███████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

1. Log in with any valid user account.
2. Capture the request when viewing a bug report attachment:

GET /BugReport/Admin/Attachment/1568600 HTTP/1.1

Host: █████████

Cookie: ████

3. Remove the entire Cookie header from the above request, so it looks like:

GET /BugReport/Admin/Attachment/1568600 HTTP/1.1

Host: █████████

4. Send the modified request without any authentication cookies.
5. Observe that the server responds with the file contents of the bug report attachment.

Result: Any unauthenticated user can view attachments of any bug report by enumerating or guessing valid IDs.

Suggested Mitigation/Remediation Actions

• Implement strict authorization checks on the /BugReport/Admin/Attachment/{id} endpoint to verify that the requesting user has permission to access the specified attachment.
• Ensure that unauthenticated requests cannot retrieve any sensitive resources by enforcing authentication at this endpoint.
• Use indirect references (e.g., random UUIDs or tokens) instead of sequential numeric IDs to reduce the risk of enumeration.
• Apply the principle of least privilege: users should only be able to access resources they are explicitly authorized to view.
• Add proper logging and monitoring for unauthorized access attempts to detect potential exploitation early.
• Consider rate limiting to prevent mass enumeration of IDs.