Craft CMS lacks an authorization check in assets/move-asset when the request includes force=1.
An authenticated Control Panel user who can manage their own assets in a volume, but does not have peer asset permissions, can move their own asset into another user’s folder with a conflicting filename. When force=1 is supplied, Craft merges/deletes the conflicting destination asset without checking whether the attacker is authorized to modify or delete that peer asset.
This appears to be related to the previous forced folder-move advisory class, but this report targets the separate actionMoveAsset() route in the latest public release.
Impact
An authenticated low-privileged control panel user can delete and replace another user’s asset in the same volume without having peer asset permissions.
This can cause:
- unauthorized deletion of another user’s asset record
- replacement of asset file bytes with attacker-controlled content
- integrity loss for entries or fields that reference the victim asset
- availability impact if important assets are removed or replaced
Report ID: 1517
Craft CMS lacks an authorization check in
assets/move-assetwhen the request includesforce=1.An authenticated Control Panel user who can manage their own assets in a volume, but does not have peer asset permissions, can move their own asset into another user’s folder with a conflicting filename. When
force=1is supplied, Craft merges/deletes the conflicting destination asset without checking whether the attacker is authorized to modify or delete that peer asset.This appears to be related to the previous forced folder-move advisory class, but this report targets the separate
actionMoveAsset()route in the latest public release.Impact
An authenticated low-privileged control panel user can delete and replace another user’s asset in the same volume without having peer asset permissions.
This can cause:
Report ID: 1517