Missing Authorization Vulnerability in Shaark API

Shaark versions 1.2.13 through 1.2.44 are affected by a missing authorization vulnerability within the Link, Story, Chest, and Album API controllers. The vulnerability stems from a failure to perform adequate ownership checks during API requests, which allows any authenticated, non-administrative user to interact with resources they do not own. By submitting crafted PUT or DELETE requests to the /api/link/{id}, /api/story/{id}, /api/chest/{id}, or /api/album/{id} endpoints with valid numeric identifiers, an attacker can overwrite or remove content belonging to other users, including items marked as private. This vulnerability significantly impacts the confidentiality and integrity of user data within the application.

Impact

Successful exploitation allows authenticated users to perform unauthorized destructive or modification operations on resources belonging to other users, including private content. This can lead to total data loss for specific user items or unauthorized modification of shared resources, potentially affecting any multi-user deployment of the Shaark application.

Recommendation

Update the Shaark application to a version beyond 1.2.44 immediately. Detection teams should monitor web server access logs for anomalous patterns of PUT or DELETE requests directed at the specified API controllers, particularly those involving sequential or high-volume ID increments from non-administrative user accounts.