Custom profile fields can be read by logged-out visitors in organization with web-public channels
Résumé
Impact
Organizations using the public access option let logged-out visitors see a limited user directory (names, avatars, roles, join dates). A missing access-control check let GET /json/users also honor include_custom_profile_fields for thes...
Description d'origine La description telle que publiée par la source (souvent en anglais).
Impact
Organizations using the public access option let logged-out visitors see a limited user directory (names, avatars, roles, join dates). A missing access-control check let GET /json/users also honor include_custom_profile_fields for these visitors, so an unauthenticated request could retrieve every user's custom profile field values in addition to the limited data that was officially documented.
Workarounds
Disable spectator access (unset web-public on all channels, or turn off "Allow creating web-public channels").
Patches
Fixed in Zulip server 12.2
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY zulip/zulip