V4: OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search
Affects github.com/OpenListTeam/OpenList/v4Source GCVE Database
- Patch
- Available – fixed in 4.2.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Gogithub.com/OpenListTeam/OpenList/v4 | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Recommended mitigations include replacing the insecure strings.HasPrefix path check with a separator-aware containment check (e.g., verifying that the target path equals the base path or starts with base path plus a path separator), enforcing path boundaries within the Bleve query itself rather than relying on post-query filtering, and calculating the total count only after applying all authorization and path filters to prevent leakage of unauthorized file existence information.
Description
OpenList v4 before 4.2.4 contains an authorization bypass and information disclosure vulnerability in its search API due to improper path prefix validation and unfiltered backend counting in the Bleve search engine. A low-privileged user can bypass BasePath restrictions to access metadata of files in unauthorized sibling directories and confirm the existence of sensitive files via the total count field. This defeats the intended namespace isolation and allows enumeration of hidden infrastructure and sensitive file metadata.
Impact
Any authenticated user with low privileges can bypass BasePath restrictions to discover and access metadata of files in unauthorized directories. They can also confirm the existence of sensitive files through the unfiltered total count returned by the search backend. This compromises confidentiality by leaking file metadata and enables enumeration of hidden infrastructure, defeating the BasePath isolation mechanism.
Summary
The vulnerability in OpenList's search API arises from two logic flaws when using the Bleve search engine: (1) an insecure path prefix check using strings.HasPrefix without path-separator awareness allows a user restricted to a BasePath (e.g., /base) to access sibling directories with similar prefixes (e.g., /base2), bypassing authorization; (2) the Bleve backend returns a global total count of matching files ignoring the BasePath boundary, enabling blind enumeration of unauthorized files even if metadata access is filtered later. This combination leads to information disclosure and horizontal/vertical privilege escalation by exposing metadata and existence of files outside the user's authorized namespace.
Weaknesses
References
- github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337 (opens in a new tab)
- github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a (opens in a new tab)
- github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679 (opens in a new tab)
- github.com/OpenListTeam/OpenList (opens in a new tab)
- github.com/OpenListTeam/OpenList/releases/tag/v4.2.4 (opens in a new tab)