Opensignserver
Monthly
Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly decline any in-flight signing document and forge the decline attribution to an arbitrary user. The vulnerable declinedoc Parse cloud function writes the IsDeclined flag, DeclineReason text, and a caller-supplied DeclineBy pointer to the document record without verifying the caller's identity, enabling both workflow termination and evidentiary record falsification. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by allowing them to mint MASTER_KEY-signed file access tokens via the getsignedurl Parse cloud function. The bypass requires no credentials and no prior knowledge of valid document records - supplying any arbitrary string as the docId parameter causes the function to skip its isAuthenticated check entirely and issue a fully trusted signed token. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass condition is trivially reproducible from the CVE description alone, making this a realistic and immediate threat to any internet-exposed instance storing sensitive signed documents.
Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - including sender and signer PII and pre-signed document download URLs - to unauthenticated remote attackers via the getDocument Parse cloud function. The function internally calls useMasterKey, bypassing Parse's ACL enforcement, and returns full records whenever the document's IsEnableOTP flag is false, which is the default configuration across all deployments. No public exploit has been identified at time of analysis, but the network-accessible, zero-authentication attack path against default configurations makes this a high-priority data protection issue, particularly for organizations subject to GDPR or similar data regulation.
Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.
Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly decline any in-flight signing document and forge the decline attribution to an arbitrary user. The vulnerable declinedoc Parse cloud function writes the IsDeclined flag, DeclineReason text, and a caller-supplied DeclineBy pointer to the document record without verifying the caller's identity, enabling both workflow termination and evidentiary record falsification. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by allowing them to mint MASTER_KEY-signed file access tokens via the getsignedurl Parse cloud function. The bypass requires no credentials and no prior knowledge of valid document records - supplying any arbitrary string as the docId parameter causes the function to skip its isAuthenticated check entirely and issue a fully trusted signed token. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass condition is trivially reproducible from the CVE description alone, making this a realistic and immediate threat to any internet-exposed instance storing sensitive signed documents.
Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - including sender and signer PII and pre-signed document download URLs - to unauthenticated remote attackers via the getDocument Parse cloud function. The function internally calls useMasterKey, bypassing Parse's ACL enforcement, and returns full records whenever the document's IsEnableOTP flag is false, which is the default configuration across all deployments. No public exploit has been identified at time of analysis, but the network-accessible, zero-authentication attack path against default configurations makes this a high-priority data protection issue, particularly for organizations subject to GDPR or similar data regulation.
Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.