Summary
PictShare before 3.7.1 exposes complete file metadata through the unauthenticated API::info() endpoint, including the secret delete_code and uploader details. An attacker who knows a file hash may retrieve this information and use the delete_code to delete files, while also exposing uploader privacy data.
Affected context
The vulnerability occurs in PictShare deployments where the API::info() endpoint can be accessed without authentication and returns raw file metadata without a field whitelist. Risk is higher when file hashes are publicly discoverable and the returned metadata includes operational secrets or uploader-identifying information.
Exploit preconditions
- Attack surface: Publicly accessible PictShare information API
- Required access: No authentication may be required; knowledge of a file hash is generally sufficient
- Trigger point: A request to the API::info() endpoint for an existing file
- Why exploitation is possible: The endpoint returns unfiltered metadata, including the delete_code, which may authorize subsequent deletion requests
Why this happens
The underlying issue is excessive exposure of sensitive metadata through an API response. Returning a complete internal metadata object instead of an explicitly approved set of fields maps to CWE-522: Insufficiently Protected Credentials, because the delete_code is a secret-like authorization value exposed to unauthenticated users. The same insecure pattern also discloses uploader and file-identifying data that should remain restricted.
Potential impact
- Attackers may permanently delete arbitrary files whose hashes they can identify
- Stored content availability and integrity could be affected
- Uploader IP addresses, remote ports, and User-Agent values may be exposed
- File hashes and other metadata could support tracking or further attacks
- Privacy obligations and trust in the file-sharing service could be impacted
General mitigation guidance
Mitigation generally focuses on reducing metadata exposure and separating public file information from authorization secrets.
Common defensive patterns include:
- Returning only explicitly whitelisted, non-sensitive fields from information endpoints
- Keeping delete codes and other authorization values out of unauthenticated responses
- Applying authentication and authorization checks to metadata and deletion operations
- Treating uploader network data and file hashes as restricted information
- Using separate, scoped, non-guessable authorization mechanisms for destructive actions
- Applying least privilege and audit controls to file deletion workflows
These patterns reduce the impact of metadata disclosure even when file identifiers are publicly visible.
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and API review rules that flag serialization of complete internal objects
- Code review checks for missing response field allowlists
- Tests that verify unauthenticated endpoints do not return secrets, tokens, delete codes, or uploader network data
- Authorization-policy checks for destructive APIs and metadata endpoints
- Monitoring for unusual sequences of information lookups followed by deletion requests
Automated API security testing and schema-conformance tools can help detect unexpected sensitive fields in responses.
