Export files can be downloaded without auth through public /uploads/exports #35

New issue

Open

opened 2026-10-18 17:16:52 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 17:16:52 +00:00

Owner

Found by Nye while reviewing #32 (pre-existing, not part of that fix).

Export files are written under <UPLOAD_PATH>/exports, and endpoint.ex serves all of UPLOAD_PATH at /uploads with Plug.Static and no auth. So /uploads/exports/fuzzy_catalog_export_<ISO timestamp>.json|csv can be downloaded by anyone who guesses the name. The timestamp goes to the microsecond, so it's hard but not impossible. The data is catalog only, no user data, hence low.

Fix: store exports outside the public dir (e.g. a separate EXPORT_PATH, or a private dir beside the uploads), or 404 /uploads/exports/* before the static plug. Downloads already go through the admin controller, so nothing legitimate uses the public path.

Found by Nye while reviewing #32 (pre-existing, not part of that fix). Export files are written under `<UPLOAD_PATH>/exports`, and `endpoint.ex` serves all of `UPLOAD_PATH` at `/uploads` with `Plug.Static` and no auth. So `/uploads/exports/fuzzy_catalog_export_<ISO timestamp>.json|csv` can be downloaded by anyone who guesses the name. The timestamp goes to the microsecond, so it's hard but not impossible. The data is catalog only, no user data, hence low. **Fix:** store exports outside the public dir (e.g. a separate `EXPORT_PATH`, or a private dir beside the uploads), or 404 `/uploads/exports/*` before the static plug. Downloads already go through the admin controller, so nothing legitimate uses the public path.

jfro added the

low

main

security

labels

2026-10-18 17:16:52 +00:00