Opensign
Monthly
Information disclosure in OpenSignLabs OpenSign through 2.37.0 exposes complete organisation tenant records to unauthenticated remote attackers via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant configuration record without any authentication or authorization check, enabling systematic enumeration of all tenant data across a multi-tenant deployment. No public exploit has been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means no specialised tooling is required.
Unauthenticated remote write to any contact record is possible in OpenSignLabs OpenSign through version 2.37.0 via the updatecontacttour Parse cloud function, which performs no authentication or authorization checks before accepting and applying updates to arbitrary contact records. Any internet-reachable deployment is vulnerable to data corruption or overwrite of contact records for all users system-wide without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability's zero-prerequisites nature and straightforward exploitation model make it a realistic target for automated abuse.
OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism, allowing any network-accessible attacker to fabricate arbitrary audit log entries by directly invoking the triggerevent Parse cloud function with caller-controlled viewer identity and IP address parameters. The vulnerability (CWE-345: Insufficient Verification of Data Authenticity) directly undermines non-repudiation in digitally signed documents, which is the legal and evidentiary foundation of electronic signature workflows. No public exploit has been identified at time of analysis, but the CVSS vector confirms the attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable against any exposed OpenSign deployment.
Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identifiable information to remote attackers without credentials. The `getcontact` Parse cloud function executes with `useMasterKey`, which bypasses Parse Server's native access control layers (ACLs and Class-Level Permissions), and contains no compensating authentication or authorization logic. Any network-reachable attacker can call this function, supply arbitrary object IDs, and retrieve full contact records including PII at scale. No public exploit has been identified at time of analysis, and no KEV listing exists.
Unauthenticated user enumeration in OpenSignLabs OpenSign through 2.37.0 exposes internal user objectIds via the getUserId Parse cloud function, which performs no authentication before resolving and returning identifiers tied to any supplied email address or username. Any remote attacker can silently map organizational email addresses or usernames to their internal Parse database identifiers without triggering authentication. This reconnaissance capability enables targeted follow-on attacks, such as credential stuffing, phishing, or chained exploitation of other endpoints that accept objectIds. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Information disclosure in OpenSignLabs OpenSign through 2.37.0 exposes complete organisation tenant records to unauthenticated remote attackers via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant configuration record without any authentication or authorization check, enabling systematic enumeration of all tenant data across a multi-tenant deployment. No public exploit has been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means no specialised tooling is required.
Unauthenticated remote write to any contact record is possible in OpenSignLabs OpenSign through version 2.37.0 via the updatecontacttour Parse cloud function, which performs no authentication or authorization checks before accepting and applying updates to arbitrary contact records. Any internet-reachable deployment is vulnerable to data corruption or overwrite of contact records for all users system-wide without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability's zero-prerequisites nature and straightforward exploitation model make it a realistic target for automated abuse.
OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism, allowing any network-accessible attacker to fabricate arbitrary audit log entries by directly invoking the triggerevent Parse cloud function with caller-controlled viewer identity and IP address parameters. The vulnerability (CWE-345: Insufficient Verification of Data Authenticity) directly undermines non-repudiation in digitally signed documents, which is the legal and evidentiary foundation of electronic signature workflows. No public exploit has been identified at time of analysis, but the CVSS vector confirms the attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable against any exposed OpenSign deployment.
Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identifiable information to remote attackers without credentials. The `getcontact` Parse cloud function executes with `useMasterKey`, which bypasses Parse Server's native access control layers (ACLs and Class-Level Permissions), and contains no compensating authentication or authorization logic. Any network-reachable attacker can call this function, supply arbitrary object IDs, and retrieve full contact records including PII at scale. No public exploit has been identified at time of analysis, and no KEV listing exists.
Unauthenticated user enumeration in OpenSignLabs OpenSign through 2.37.0 exposes internal user objectIds via the getUserId Parse cloud function, which performs no authentication before resolving and returning identifiers tied to any supplied email address or username. Any remote attacker can silently map organizational email addresses or usernames to their internal Parse database identifiers without triggering authentication. This reconnaissance capability enables targeted follow-on attacks, such as credential stuffing, phishing, or chained exploitation of other endpoints that accept objectIds. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.