Summary
Goobi viewer may accept an empty token for endpoints protected by its authorization binding when no web API token has been configured. An attacker who can reach such an endpoint could bypass the intended token check and access functionality without valid authentication.
Goobi viewer may accept an empty token for endpoints protected by its authorization binding when no web API token has been configured. An attacker who can reach such an endpoint could bypass the intended token check and access functionality without valid authentication.
Affected context
The issue occurs in Goobi viewer deployments where the web API authorization token is left unconfigured and protected endpoints rely on AuthorizationFilter. In that configuration, the application represents the missing token as an empty string and compares it with a supplied empty token without first rejecting the unset security configuration.
The issue occurs in Goobi viewer deployments where the web API authorization token is left unconfigured and protected endpoints rely on AuthorizationFilter. In that configuration, the application represents the missing token as an empty string and compares it with a supplied empty token without first rejecting the unset security configuration.
Exploit preconditions
- Attack surface: HTTP requests to web API endpoints protected by
@AuthorizationBinding - Required access: Network access to a vulnerable Goobi viewer instance; no valid token is required
- Trigger point: Authorization processing for a request containing an empty
tokenparameter - Why exploitation is possible: An absent configured token is treated as an acceptable empty value instead of disabling or rejecting token-based authorization
- Attack surface: HTTP requests to web API endpoints protected by
@AuthorizationBinding - Required access: Network access to a vulnerable Goobi viewer instance; no valid token is required
- Trigger point: Authorization processing for a request containing an empty
tokenparameter - Why exploitation is possible: An absent configured token is treated as an acceptable empty value instead of disabling or rejecting token-based authorization
Why this happens
The underlying bug is an authentication-state validation failure. Configuration.getWebApiToken returns an empty string when the token is not configured, while AuthorizationFilter compares that value directly with the supplied token. This maps primarily to CWE-287: Improper Authentication, because the application accepts a request without establishing possession of a valid credential. It is also related to CWE-1392, where an empty or missing credential is handled as though it were a valid authentication value.
The underlying bug is an authentication-state validation failure. Configuration.getWebApiToken returns an empty string when the token is not configured, while AuthorizationFilter compares that value directly with the supplied token. This maps primarily to CWE-287: Improper Authentication, because the application accepts a request without establishing possession of a valid credential. It is also related to CWE-1392, where an empty or missing credential is handled as though it were a valid authentication value.
Potential impact
- Unauthorized users may access protected web API functionality
- Attackers could retrieve or manipulate data exposed through affected endpoints
- Application workflows relying on token-based authorization may be bypassed
- Compromised API access could support further abuse of connected services, depending on permissions
- Unauthorized users may access protected web API functionality
- Attackers could retrieve or manipulate data exposed through affected endpoints
- Application workflows relying on token-based authorization may be bypassed
- Compromised API access could support further abuse of connected services, depending on permissions
General mitigation guidance
Mitigation generally focuses on making missing authentication configuration fail closed rather than treating it as a credential.
Defensive patterns include:
- Rejecting requests whenever the configured authorization token is absent, empty, or otherwise invalid
- Separating "authentication is not configured" from "an empty credential was supplied"
- Requiring non-empty, high-entropy secrets for protected API deployments
- Applying least privilege to identities and operations exposed through the web API
- Ensuring protected endpoints are not enabled unless their authentication policy is complete
- Using centralized authorization logic with explicit handling for missing, malformed, and invalid credentials
Mitigation generally focuses on making missing authentication configuration fail closed rather than treating it as a credential.
Defensive patterns include:
- Rejecting requests whenever the configured authorization token is absent, empty, or otherwise invalid
- Separating "authentication is not configured" from "an empty credential was supplied"
- Requiring non-empty, high-entropy secrets for protected API deployments
- Applying least privilege to identities and operations exposed through the web API
- Ensuring protected endpoints are not enabled unless their authentication policy is complete
- Using centralized authorization logic with explicit handling for missing, malformed, and invalid credentials
How teams detect issues like this
Detection can combine source review, runtime testing, and configuration policy enforcement.
- Use static analysis to identify authentication comparisons involving empty strings, nullable configuration values, or default credentials.
- Review authorization filters and middleware for fail-open behavior when secrets are unset.
- Test protected endpoints with missing, empty, malformed, and invalid token values.
- Monitor requests containing empty token parameters and correlate them with successful responses from protected routes.
- Enforce deployment policies that reject configurations with missing or blank API authentication secrets.
- Automated code review and security testing tools may help identify credential validation paths that do not distinguish absent configuration from valid authentication.
Detection can combine source review, runtime testing, and configuration policy enforcement.
- Use static analysis to identify authentication comparisons involving empty strings, nullable configuration values, or default credentials.
- Review authorization filters and middleware for fail-open behavior when secrets are unset.
- Test protected endpoints with missing, empty, malformed, and invalid token values.
- Monitor requests containing empty token parameters and correlate them with successful responses from protected routes.
- Enforce deployment policies that reject configurations with missing or blank API authentication secrets.
- Automated code review and security testing tools may help identify credential validation paths that do not distinguish absent configuration from valid authentication.
