Multiple High-Severity Issues in Community <=9.3.1 (SQLi, Auth Bypass, IDORs, SSRF, RCE patterns)

[Ikram-4]

About: Review of logicaldoc/community 9.3.1 (c3c51cd), reproduced on logicaldoc-ce:9.2.0 Docker + mysql:8.0. Details withheld, only root-cause.

1. SQL Injection — tag search About: firstLetter filter concatenated into raw SQL with formatted(), no binding. Sibling method uses :tagLike correctly. Authenticated low-priv data exfiltration.

logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java:663-668
logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java:41,127-128
logicaldoc-core/src/main/java/com/logicaldoc/core/HibernatePersistentObjectDAO.java:430-447

2. HQL Injection — document list indexed About: indexed request param formatted directly into HQL. Other params in same query use named params. Authenticated query manipulation with HQL error disclosure.

logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/DocumentsDataServlet.java:447-448,456-459

3. Authentication bypass — log download About: checkMenu(LOGS) failure only calls sendError, missing return, continues to prepareAllSupportResources() + downloadLogFile(). Unauthenticated support-zip with logs/config/env/DB meta.

logicaldoc-webapp/src/main/java/com/logicaldoc/web/LogDownload.java:64-69,79-96,133-220
logicaldoc-webapp/src/main/java/com/logicaldoc/web/util/ServletUtil.java:124-133,803-805

4. Unauthenticated temp upload About: doPost uses getUploadDir(request) falling back to anonymous HttpSession dir, no validateSession. Only denylist check. Anonymous disk-fill + staging.

logicaldoc-webapp/src/main/java/com/logicaldoc/web/UploadServlet.java:122-130,238-257,250-311

5. Unauthenticated avatar disclosure / user oracle About: No validateSession/checkMenu, reads userId param directly. Anonymous avatar + existence oracle.

logicaldoc-webapp/src/main/java/com/logicaldoc/web/AvatarServlet.java:60-76

6. Password recovery ticket not bound to user About: Lookup by ticketId, then separate lookup by userId param, no ticket.userId==userId check. Ticket disabled before user lookup. Own valid ticket can reset arbitrary account.

logicaldoc-webapp/src/main/java/com/logicaldoc/web/PswRecovery.java:89-101,120-165
logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/LoginServiceImpl.java:110-123
logicaldoc-core/src/main/java/com/logicaldoc/core/ticket/Ticket.java:55-65,175-181,317-322

7. IDOR — PDF conversion download About: Only validateSession, no isDownloadAllowed/isReadAllowed/checkPublished unlike DownloadServlet/ThumbnailServlet. Low-priv download of private PDFs by docId.

logicaldoc-webapp/src/main/java/com/logicaldoc/web/ConvertPdf.java:56-79

8. IDORs — document copy / deleteVersion / reindex / extracted-text About: restore/copy/reindex/deleteVersion/getExtractedText/deleteLink call only validateSession, no source READ/WRITE/DELETE check. copyToFolder/deleteVersion/index downstream also lack checks. Low-priv copy-out, version destruction, index poisoning, text disclosure.

logicaldoc-webservice/src/main/java/com/logicaldoc/webservice/soap/endpoint/SoapDocumentService.java:508-516,461-475,815-822,1163-1173,945-948,938-941
logicaldoc-webservice/src/main/java/com/logicaldoc/webservice/rest/endpoint/RestDocumentService.java:899-911,527,844-858,408,751-762,704
logicaldoc-core/src/main/java/com/logicaldoc/core/transfer/ZipExport.java:233-248
logicaldoc-webapp/src/main/java/com/logicaldoc/web/ExportZip.java:51-114
logicaldoc-webapp/src/main/java/com/logicaldoc/web/TicketDownload.java:183-197,274

9. Automation Velocity sandbox bypass → RCE About: forbidRuntimeUsage only blocks java.lang.Runtime string + getRuntime|runtime regex. Dictionary exposes Paths,Math,Context, all @AutomationDictionary beans including ClassTool (only blocks exact Runtime, allows ProcessBuilder), SystemTool.exec(), HttpTool, ContextTool. GWT sendAsEmail evaluates user message/subject with full dict after only validateSession.

logicaldoc-core/src/main/java/com/logicaldoc/core/automation/Automation.java:140-226,292-320
logicaldoc-core/src/main/java/com/logicaldoc/core/automation/ClassTool.java:43-55,70-80
logicaldoc-core/src/main/java/com/logicaldoc/core/automation/SystemTool.java:29-76
logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java:1495-1505

10. SSRF + XSLT via XML converter About: XML <?xml-stylesheet href> fetched via copyURLToFile(UrlUtil.toURL(href)) with no allowlist (http/file/ftp/jar allowed), then compiled with TransformerFactory.newInstance() without FEATURE_SECURE_PROCESSING / ACCESS_EXTERNAL_*. Upload + convertToPdf triggers outbound fetch + malicious XSLT.

logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java:54-76,96-113,186-260
logicaldoc-util/src/main/java/com/logicaldoc/util/http/UrlUtil.java:99-103

11. Converter command handling + store name sanitizer About: saveSettings/saveSetting writes any converter.*.path/arguments with no allowlist (admin). Exec.checkAllowed uses startsWith prefix and empty-set fail-open; prod allowlist exists but still allows flag injection into gs/convert. StoreResource.sanitize does single .. remove then strips /, allowing ./.→.. re-formation, \ allowed (Windows escape).

logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/SettingServiceImpl.java:248-293,488
logicaldoc-util/src/main/java/com/logicaldoc/util/exec/Exec.java:516-537,544-587
logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/GhostscriptConverter.java:31-62
logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/ImageConverter.java:31-69
logicaldoc-core/src/main/java/com/logicaldoc/core/store/StoreResource.java:86-88,129-131
logicaldoc-core/src/main/java/com/logicaldoc/core/store/FSStore.java:85,100,122-123
Affected: <=9.3.1, 9.2.0 Docker confirmed. Private PoC available for maintainers.