Summary

The external storage feature allows any user to enumerate the name and content of files on the server

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

PoC

Create a new storage backend

Use it with an arbitray path, e.g. /opt/recipes/mediafiles/files

Click "Sync Now" and tandoor shows all filenames in the specified directory

This way it's e.g. possible to enumerate all uploaded files, even those from other users/spaces

The files in the mediafiles/files directory can then be viewed/downloaded

Further, we can import and view PDFs from ANY directiory

But it is also possible to enumerate files in other directories such as /etc

While the tandoor doesn't show their content in the frontend, because they are not PDF files, nor are in the mediafiles directory, we can use the API endpoint /api/get_recipe_file/[ID] in order to get the content.

E.g. here is the content of the /etc/passwd file

or the content of the /root/.ash_history file

Impact

We can view the content of any file on the server