Opensignlabs
Monthly
Information disclosure in OpenSignLabs OpenSign through 2.37.0 exposes complete organisation tenant records to unauthenticated remote attackers via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant configuration record without any authentication or authorization check, enabling systematic enumeration of all tenant data across a multi-tenant deployment. No public exploit has been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means no specialised tooling is required.
Unauthenticated remote write to any contact record is possible in OpenSignLabs OpenSign through version 2.37.0 via the updatecontacttour Parse cloud function, which performs no authentication or authorization checks before accepting and applying updates to arbitrary contact records. Any internet-reachable deployment is vulnerable to data corruption or overwrite of contact records for all users system-wide without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability's zero-prerequisites nature and straightforward exploitation model make it a realistic target for automated abuse.
OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism, allowing any network-accessible attacker to fabricate arbitrary audit log entries by directly invoking the triggerevent Parse cloud function with caller-controlled viewer identity and IP address parameters. The vulnerability (CWE-345: Insufficient Verification of Data Authenticity) directly undermines non-repudiation in digitally signed documents, which is the legal and evidentiary foundation of electronic signature workflows. No public exploit has been identified at time of analysis, but the CVSS vector confirms the attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable against any exposed OpenSign deployment.
Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identifiable information to remote attackers without credentials. The `getcontact` Parse cloud function executes with `useMasterKey`, which bypasses Parse Server's native access control layers (ACLs and Class-Level Permissions), and contains no compensating authentication or authorization logic. Any network-reachable attacker can call this function, supply arbitrary object IDs, and retrieve full contact records including PII at scale. No public exploit has been identified at time of analysis, and no KEV listing exists.
Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly decline any in-flight signing document and forge the decline attribution to an arbitrary user. The vulnerable declinedoc Parse cloud function writes the IsDeclined flag, DeclineReason text, and a caller-supplied DeclineBy pointer to the document record without verifying the caller's identity, enabling both workflow termination and evidentiary record falsification. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by allowing them to mint MASTER_KEY-signed file access tokens via the getsignedurl Parse cloud function. The bypass requires no credentials and no prior knowledge of valid document records - supplying any arbitrary string as the docId parameter causes the function to skip its isAuthenticated check entirely and issue a fully trusted signed token. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass condition is trivially reproducible from the CVE description alone, making this a realistic and immediate threat to any internet-exposed instance storing sensitive signed documents.
Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - including sender and signer PII and pre-signed document download URLs - to unauthenticated remote attackers via the getDocument Parse cloud function. The function internally calls useMasterKey, bypassing Parse's ACL enforcement, and returns full records whenever the document's IsEnableOTP flag is false, which is the default configuration across all deployments. No public exploit has been identified at time of analysis, but the network-accessible, zero-authentication attack path against default configurations makes this a high-priority data protection issue, particularly for organizations subject to GDPR or similar data regulation.
Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.
Unauthenticated user enumeration in OpenSignLabs OpenSign through 2.37.0 exposes internal user objectIds via the getUserId Parse cloud function, which performs no authentication before resolving and returning identifiers tied to any supplied email address or username. Any remote attacker can silently map organizational email addresses or usernames to their internal Parse database identifiers without triggering authentication. This reconnaissance capability enables targeted follow-on attacks, such as credential stuffing, phishing, or chained exploitation of other endpoints that accept objectIds. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Information disclosure in OpenSignLabs OpenSign through 2.37.0 exposes complete organisation tenant records to unauthenticated remote attackers via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant configuration record without any authentication or authorization check, enabling systematic enumeration of all tenant data across a multi-tenant deployment. No public exploit has been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means no specialised tooling is required.
Unauthenticated remote write to any contact record is possible in OpenSignLabs OpenSign through version 2.37.0 via the updatecontacttour Parse cloud function, which performs no authentication or authorization checks before accepting and applying updates to arbitrary contact records. Any internet-reachable deployment is vulnerable to data corruption or overwrite of contact records for all users system-wide without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability's zero-prerequisites nature and straightforward exploitation model make it a realistic target for automated abuse.
OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism, allowing any network-accessible attacker to fabricate arbitrary audit log entries by directly invoking the triggerevent Parse cloud function with caller-controlled viewer identity and IP address parameters. The vulnerability (CWE-345: Insufficient Verification of Data Authenticity) directly undermines non-repudiation in digitally signed documents, which is the legal and evidentiary foundation of electronic signature workflows. No public exploit has been identified at time of analysis, but the CVSS vector confirms the attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable against any exposed OpenSign deployment.
Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identifiable information to remote attackers without credentials. The `getcontact` Parse cloud function executes with `useMasterKey`, which bypasses Parse Server's native access control layers (ACLs and Class-Level Permissions), and contains no compensating authentication or authorization logic. Any network-reachable attacker can call this function, supply arbitrary object IDs, and retrieve full contact records including PII at scale. No public exploit has been identified at time of analysis, and no KEV listing exists.
Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly decline any in-flight signing document and forge the decline attribution to an arbitrary user. The vulnerable declinedoc Parse cloud function writes the IsDeclined flag, DeclineReason text, and a caller-supplied DeclineBy pointer to the document record without verifying the caller's identity, enabling both workflow termination and evidentiary record falsification. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by allowing them to mint MASTER_KEY-signed file access tokens via the getsignedurl Parse cloud function. The bypass requires no credentials and no prior knowledge of valid document records - supplying any arbitrary string as the docId parameter causes the function to skip its isAuthenticated check entirely and issue a fully trusted signed token. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass condition is trivially reproducible from the CVE description alone, making this a realistic and immediate threat to any internet-exposed instance storing sensitive signed documents.
Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - including sender and signer PII and pre-signed document download URLs - to unauthenticated remote attackers via the getDocument Parse cloud function. The function internally calls useMasterKey, bypassing Parse's ACL enforcement, and returns full records whenever the document's IsEnableOTP flag is false, which is the default configuration across all deployments. No public exploit has been identified at time of analysis, but the network-accessible, zero-authentication attack path against default configurations makes this a high-priority data protection issue, particularly for organizations subject to GDPR or similar data regulation.
Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.
Unauthenticated user enumeration in OpenSignLabs OpenSign through 2.37.0 exposes internal user objectIds via the getUserId Parse cloud function, which performs no authentication before resolving and returning identifiers tied to any supplied email address or username. Any remote attacker can silently map organizational email addresses or usernames to their internal Parse database identifiers without triggering authentication. This reconnaissance capability enables targeted follow-on attacks, such as credential stuffing, phishing, or chained exploitation of other endpoints that accept objectIds. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.