Auth bypass in Haiwen Seafile-Server
CVE-2021-43820
Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.010 (58.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Haiwen Seafile-server — versions Community Edition < 8.0.8, Pro Edition < 8.0.15
- Seafile Seafile_server
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-43820?
- CVE-2021-43820 is a high-severity vulnerability in Haiwen Seafile-Server, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.4/10. Published 2021-12-14.
- How severe is CVE-2021-43820?
- High severity. CVSS v3 base score is 7.4 out of 10.