CyberRota Analysis
AI-GeneratedOpenSignLabs opensignserver versions up to 2.37.0 are vulnerable due to a missing authentication flaw that allows unauthenticated remote attackers to access arbitrary stored documents via the fileupload Parse cloud function. This vulnerability undermines access controls by generating MASTER_KEY-signed file access tokens for any provided URL without session verification, potentially exposing sensitive contract files. Organizations using this software should prioritize remediation to protect against unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.