CyberRota Analysis
AI-GeneratedOpenSignLabs' opensignserver versions up to 2.37.0 are vulnerable due to a missing authorization check in the declinedoc Parse cloud function, allowing unauthenticated remote attackers to decline documents and falsify decline attributions. This vulnerability can lead to unauthorized workflow termination and manipulation of evidentiary records, posing significant risks to document integrity and trust. Organizations utilizing this software, particularly those handling sensitive or legally binding documents, should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.