Summary
YesWiki contains a missing authorization check in its attachment download handler, allowing unauthenticated requests to bypass page read access controls. An attacker who knows a page tag and file parameter may retrieve confidential attachments associated with pages intended to be restricted.
Affected context
The issue can occur in YesWiki deployments where attachment downloads are handled without consistently enforcing the read ACL of the associated page. Risk is higher when sensitive files are attached to pages with restricted readership and the page identifier or attachment name can be discovered or inferred.
Exploit preconditions
- Attack surface: The publicly reachable attachment download handler
- Required access: No authenticated account may be required
- Trigger point: A download request containing a known page tag and file parameter
- Why exploitation is possible: The handler may retrieve the attachment without verifying that the requester is authorized to read the associated page
Why this happens
The underlying flaw is an authorization enforcement gap in a resource download path. The handler uses caller-supplied page and file references to locate an attachment but does not reliably apply the page's read access control before returning it. This behavior maps to CWE-862: Missing Authorization, where a protected operation is available without an effective permission check.
Potential impact
- Unauthorized users may access confidential attachments
- Restricted documents or other sensitive files could be disclosed
- Privacy, compliance, or contractual obligations may be affected
- Exposed information could support further attacks against users or systems
General mitigation guidance
Mitigation generally focuses on making authorization checks mandatory for every attachment retrieval path.
Common defensive patterns include:
- Enforcing the associated page's read ACL before resolving or returning an attachment
- Applying deny-by-default authorization for unauthenticated download requests
- Avoiding direct reliance on user-supplied page and file identifiers
- Using centralized authorization middleware or policy checks for protected resources
- Limiting attachment storage and runtime identities according to least privilege
- Reviewing existing attachments and access policies for sensitive content
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and code review checks for download handlers that lack authorization calls
- Tracing whether every file-serving route derives and enforces the owning resource's permissions
- Tests that request restricted attachments as anonymous and unauthorized users
- Policy checks requiring authorization before file lookup or response generation
- Monitoring for repeated anonymous requests containing page and attachment identifiers
Automated security testing and code review tools may help flag resource access paths with inconsistent permission enforcement.
