Cross-user report access in CERT.LV’s Graphoscope

§ 01. Overview

Graphoscope is CERT.LV's open-source analysis platform. Analysts query many independent data sources – passive DNS, client databases, leaked-credential sets and others – from one web interface and see the results as a graph of related entities. A user can upload a list of indicators for batch processing; the server queries every connected source and stores the result as a report the user downloads later.

OffSeq found that the download endpoint did not tie a report to its owner. Any signed-in user could retrieve any other user's processed report.

§ 02. Root cause

downloadHandler verified only that the request carried a valid session and that the requested name contained neither .. nor /. It then served the file with http.ServeFile from upload/processed/ – with no check that the requester owned it.

Report names are not secret. They follow a deterministic <timestamp>-<original-name> pattern, with the timestamp taken from a one-second clock, so the timestamp can be enumerated and only the original filename has to be guessed:

1# account B downloads account A's processed report2curl -sk -b attacker.jar \3  "https://HOST:8443/download?file=20260514-102943%2B03-victim-secret.txt" \4  -o stolen.bin5# HTTP 200 – the victim's full graph and indicator data

Rejected requests also returned an empty response with no error status.

§ 03. Impact

A processed report contains the user's uploaded indicator list and the results of querying every connected data source. On a threat-intelligence platform that is sensitive by definition: it reveals which indicators an analyst is investigating and what the connected sources returned for them.

The attack needs only an ordinary account on the same instance – Graphoscope allows self-registration – and no interaction from the victim. Its one condition is the victim's original filename: names that analysts commonly use, such as indicators.txt or iocs.csv, make that guess practical, while a distinctive name makes it hard. That dependency is why the CVSS vector rates attack complexity as high.

§ 04. The fix

OffSeq contributed a fix in upload.go that authorises each download against the requester's own records:

• the filename filter additionally rejects empty names, backslashes and NUL bytes;
• the handler loads the requester's account and serves the file only if it appears in that account's Uploads.Out list;
• rejected names and cross-user attempts return 404 Not Found and write a server-side log entry (Unauthorized download attempt).

Retesting showed the cross-user request returning 404 while the owner's own download still returned the 834-byte report unchanged. CERT.LV merged the change as pull request #11.