Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes
该报告还没有中文解读。
原文摘录
摘自原文（3622 字符中的一小部分）
Summary: The approval workflow includes a protection intended to prevent an approver from approving or rejecting a file whose contents changed after review, using the file etag. However, the backend only enforces this check when the etag parameter is present and non-empty. An attacker can intercept …
原文中的代码
PUT /ocs/v2.php/apps/approval/api/v1/approve/14831 HTTP/1.1 Host: 172.16.88.96:8081 Content-Length: 19 requesttoken: VG7aXKzexiptXUcHCI4D3kSYtm7Ka9qPYV/cPqY98nQ=:PQucC5msr3wlKB5GYd157nHO0RSPIYnGI3SUe/YMkwE= X-Requested-With: XMLHttpRequest, XMLHttpRequest Accept-Language: vi-VN,vi;q=0.9 Accept: …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @vidang04 · 版权归作者与 Nextcloud 所有