Summary
REDAXO contains a missing authorization check in the media pool bulk-move function. An authenticated backend user who can access one media category may move files from restricted categories into it and replace their contents across the site.
REDAXO contains a missing authorization check in the media pool bulk-move function. An authenticated backend user who can access one media category may move files from restricted categories into it and replace their contents across the site.
Affected context
The issue affects REDAXO deployments using the media pool bulk-move feature where authorization is evaluated only for the destination category. The source category's permissions may not be checked, allowing a user with limited media-category access to act on files stored in categories they cannot otherwise manage. The affected behavior is present in REDAXO versions before 5.21.4.
The issue affects REDAXO deployments using the media pool bulk-move feature where authorization is evaluated only for the destination category. The source category's permissions may not be checked, allowing a user with limited media-category access to act on files stored in categories they cannot otherwise manage. The affected behavior is present in REDAXO versions before 5.21.4.
Exploit preconditions
- Attack surface: Authenticated REDAXO backend media-management functionality
- Required access: A valid backend account with permission to manage at least one media category
- Trigger point: Bulk-moving media files into an authorized destination category
- Why exploitation is possible: The operation validates destination-category access while failing to verify authorization for the source category and its files
- Attack surface: Authenticated REDAXO backend media-management functionality
- Required access: A valid backend account with permission to manage at least one media category
- Trigger point: Bulk-moving media files into an authorized destination category
- Why exploitation is possible: The operation validates destination-category access while failing to verify authorization for the source category and its files
Why this happens
The underlying defect is an incomplete authorization decision in a resource transfer operation. The application checks whether the user may write to the target category but does not independently verify whether the user may read, move, or modify resources in the source category. This maps to CWE-639, Authorization Bypass Through User-Controlled Key, because an attacker can influence the category or resource identifier used by the operation without an equivalent authorization check on the referenced source object.
The underlying defect is an incomplete authorization decision in a resource transfer operation. The application checks whether the user may write to the target category but does not independently verify whether the user may read, move, or modify resources in the source category. This maps to CWE-639, Authorization Bypass Through User-Controlled Key, because an attacker can influence the category or resource identifier used by the operation without an equivalent authorization check on the referenced source object.
Potential impact
- An attacker may move files out of restricted media categories.
- Restricted media content could be replaced or altered across the site.
- Public pages may display attacker-controlled or unauthorized files.
- Content integrity and editorial workflows could be disrupted.
- The issue could contribute to reputational or operational damage.
- An attacker may move files out of restricted media categories.
- Restricted media content could be replaced or altered across the site.
- Public pages may display attacker-controlled or unauthorized files.
- Content integrity and editorial workflows could be disrupted.
- The issue could contribute to reputational or operational damage.
General mitigation guidance
Mitigation should apply authorization checks to every object and category
involved in a bulk operation, rather than relying only on destination
permissions.
Common defensive patterns include:
- Enforcing source-category read, move, and modification permissions for each selected file.
- Rechecking authorization server-side for every bulk-operation identifier.
- Using centralized, deny-by-default authorization policies.
- Avoiding trust in client-supplied category or media identifiers.
- Preserving least privilege for backend roles and separating media-management duties.
- Recording and reviewing bulk media actions for accountability.
Mitigation should apply authorization checks to every object and category
involved in a bulk operation, rather than relying only on destination
permissions.
Common defensive patterns include:
- Enforcing source-category read, move, and modification permissions for each selected file.
- Rechecking authorization server-side for every bulk-operation identifier.
- Using centralized, deny-by-default authorization policies.
- Avoiding trust in client-supplied category or media identifiers.
- Preserving least privilege for backend roles and separating media-management duties.
- Recording and reviewing bulk media actions for accountability.
How teams detect issues like this
Detection can include:
- Static analysis for authorization checks that validate only destination resources.
- Code review of bulk, move, copy, rename, and import handlers for per-object permission enforcement.
- Tests that attempt cross-category operations using accounts with destination-only permissions.
- Monitoring audit logs for media moves involving categories outside a user's normal scope.
- Policy enforcement requiring authorization decisions to occur server-side before each state-changing operation.
Automated security review tools may help identify inconsistent access-control paths, but should be supplemented with authorization-focused tests.
Detection can include:
- Static analysis for authorization checks that validate only destination resources.
- Code review of bulk, move, copy, rename, and import handlers for per-object permission enforcement.
- Tests that attempt cross-category operations using accounts with destination-only permissions.
- Monitoring audit logs for media moves involving categories outside a user's normal scope.
- Policy enforcement requiring authorization decisions to occur server-side before each state-changing operation.
Automated security review tools may help identify inconsistent access-control paths, but should be supplemented with authorization-focused tests.
