0027262: Private files can be downloaded by attacker

ID	Project	Category	View Status	Date Submitted	Last Update
0027262	mantisbt	security	public	2020-09-08 22:50	2020-12-30 08:33

Reporter	d3vpoo1	Assigned To	dregad
Priority	high	Severity	minor	Reproducibility	always
Status	closed	Resolution	duplicate
Platform	Windows	OS	Windows	OS Version	Windows 10
Product Version	2.24.2

Summary	0027262: Private files can be downloaded by attacker
Description	Though this issue seems to be a functionality, the attacker can abuse this and view/download the private files due to guessable id (increment_id)
Steps To Reproduce	Create an admin account Go to notes and upload an image with it (make sure the image/file is private) As attacker(reporter account) go to http://localhost/mantisbt2/file_download.php?file_id=<FUZZ_ID>&type=bug where the FUZZ_ID is the id of the private file The attacker successfully download other files + the private files
Additional Information	I test this issue with viewer permission and it seems that it validates the endpoint..
Tags	No tags attached.
Attached Files	admin_private_file.png (7,020 bytes) admin_private_file.png (7,020 bytes) reporter_download.png (23,070 bytes) reporter_download.png (23,070 bytes) viewer.png (14,080 bytes) viewer.png (14,080 bytes)

dregad 2020-09-09 04:12 developer ~0064386	Thanks for your report. This issue has been reported previously (0027039) but as the issue is private you do not currently have access to it. I'm resolving this as duplicate.