Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/geo-chen/oss/blob/main/docs.md
disclosure@vulncheck.com
https://github.com/suitenumerique/docs
disclosure@vulncheck.com
https://github.com/suitenumerique/docs/blob/v5.3.0/src/backend/core/api/viewset…
disclosure@vulncheck.com
https://github.com/suitenumerique/docs/commit/d35b81a6ed526dc284c8d0f68b762f2e8…
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/docs-before-5.4.1-stale-collaboration-sess…
disclosure@vulncheck.com