Summary
Goobi viewer's DownloadTaskEndpoint WebSocket accepts download requests without requiring authentication. An unauthenticated remote user may therefore initiate downloads or access downloadable material exposed through the endpoint when the affected functionality is reachable.
Goobi viewer's DownloadTaskEndpoint WebSocket accepts download requests without requiring authentication. An unauthenticated remote user may therefore initiate downloads or access downloadable material exposed through the endpoint when the affected functionality is reachable.
Affected context
The issue affects Goobi viewer deployments using goobi-viewer-core versions from 24.03 through before 26.05. The vulnerable component is the /tasks/download/monitor.socket WebSocket endpoint, where download-related requests can be accepted without an authenticated user context.
The issue affects Goobi viewer deployments using goobi-viewer-core versions from 24.03 through before 26.05. The vulnerable component is the /tasks/download/monitor.socket WebSocket endpoint, where download-related requests can be accepted without an authenticated user context.
Exploit preconditions
- Attack surface: Network-accessible Goobi viewer web application
- Required access: No prior authentication is required when the endpoint is exposed
- Trigger point: Requests sent to the DownloadTaskEndpoint WebSocket
- Why exploitation is possible: The endpoint processes download requests without consistently enforcing an authentication check before access is granted
- Attack surface: Network-accessible Goobi viewer web application
- Required access: No prior authentication is required when the endpoint is exposed
- Trigger point: Requests sent to the DownloadTaskEndpoint WebSocket
- Why exploitation is possible: The endpoint processes download requests without consistently enforcing an authentication check before access is granted
Why this happens
The underlying bug is an authentication enforcement failure. A security-sensitive download endpoint accepts requests without first establishing that the caller has a valid authenticated identity and the necessary authorization.
This maps primarily to CWE-306: Missing Authentication for Critical Function. Depending on deployment configuration and the material exposed, the behavior may also contribute to CWE-552: Files or Directories Accessible to External Parties and CWE-918: Server-Side Request Forgery risks if downloaded resources are resolved through server-side or externally influenced URLs.
The underlying bug is an authentication enforcement failure. A security-sensitive download endpoint accepts requests without first establishing that the caller has a valid authenticated identity and the necessary authorization.
This maps primarily to CWE-306: Missing Authentication for Critical Function. Depending on deployment configuration and the material exposed, the behavior may also contribute to CWE-552: Files or Directories Accessible to External Parties and CWE-918: Server-Side Request Forgery risks if downloaded resources are resolved through server-side or externally influenced URLs.
Potential impact
- Unauthenticated users may initiate download operations
- Sensitive digitised material could be disclosed
- Attackers could consume server, storage, or bandwidth resources through unauthorized downloads
- Download activity may bypass intended user-level access controls
- The endpoint could provide a pathway to broader exposure if it accesses externally influenced resources
- Unauthenticated users may initiate download operations
- Sensitive digitised material could be disclosed
- Attackers could consume server, storage, or bandwidth resources through unauthorized downloads
- Download activity may bypass intended user-level access controls
- The endpoint could provide a pathway to broader exposure if it accesses externally influenced resources
General mitigation guidance
Mitigation generally focuses on enforcing authentication and authorization at the endpoint boundary rather than relying on surrounding application behavior.
Common defensive patterns include:
- Require a validated user session or equivalent strong authentication before processing WebSocket messages
- Apply object-level authorization to every requested download and resource identifier
- Use secure-by-default deny rules when identity or permission checks are unavailable
- Restrict downloadable resources to an explicit allowlist and avoid externally controlled resource locations
- Apply rate limits, quota controls, and request-size restrictions to reduce abuse
- Run the application with only the filesystem and network privileges it needs
- Ensure authentication and authorization decisions are consistently enforced across HTTP and WebSocket paths
Mitigation generally focuses on enforcing authentication and authorization at the endpoint boundary rather than relying on surrounding application behavior.
Common defensive patterns include:
- Require a validated user session or equivalent strong authentication before processing WebSocket messages
- Apply object-level authorization to every requested download and resource identifier
- Use secure-by-default deny rules when identity or permission checks are unavailable
- Restrict downloadable resources to an explicit allowlist and avoid externally controlled resource locations
- Apply rate limits, quota controls, and request-size restrictions to reduce abuse
- Run the application with only the filesystem and network privileges it needs
- Ensure authentication and authorization decisions are consistently enforced across HTTP and WebSocket paths
How teams detect issues like this
Detection can combine application review, runtime monitoring, and policy checks.
- Use static analysis and code review to identify WebSocket handlers that process downloads before authentication or authorization checks
- Trace every download request from connection establishment through resource resolution and verify that identity and object permissions are enforced
- Add integration tests that submit unauthenticated WebSocket requests and confirm denial
- Monitor logs for download activity associated with missing, invalid, or anonymous sessions
- Enforce API policies requiring authentication metadata and authorization decisions for security-sensitive WebSocket operations
- Use automated security review tools as a neutral supplementary control for identifying missing access-control checks
Detection can combine application review, runtime monitoring, and policy checks.
- Use static analysis and code review to identify WebSocket handlers that process downloads before authentication or authorization checks
- Trace every download request from connection establishment through resource resolution and verify that identity and object permissions are enforced
- Add integration tests that submit unauthenticated WebSocket requests and confirm denial
- Monitor logs for download activity associated with missing, invalid, or anonymous sessions
- Enforce API policies requiring authentication metadata and authorization decisions for security-sensitive WebSocket operations
- Use automated security review tools as a neutral supplementary control for identifying missing access-control checks
