Description

Hi there, I would like to report an improper privilege management in PatrowlManager - it's an IDOR. All imports findings file is placed under /media/imports/<owner_id>/<tmp_file> In that, owner_id is predictable and tmp_file is in format of import_<ownder_id>_<time_created>, for example: import_1_1639213059582.json This filename is predictable and allows anyone without logging in to download all finding import files

Proof of Concept

1. Install PatrowlManager on local.
2. Go to Finding -> Manual Import, choose a file and import finding.
3. See that a new file with format import_<ownder_id>_<time_created> is created under folder media/imports/<owner_id>.
4. Now open an anonymous browser tab and access the link http://localhost:8083/media/imports/<owner_id>/<tmp_file>.
5. See that you can download the file without logging in

Impact

This vulnerability is capable of allowing unlogged in users to download all finding imports file