Attack Chain

1. Attacker identifies a target document ID, typically by intercepting or observing guest signing links sent to authorized recipients.
2. Attacker verifies that the target document environment is configured with OTP verification disabled, a prerequisite for the bypass.
3. Attacker crafts an HTTP GET or POST request targeting the 'getDocument' cloud function endpoint.
4. Attacker includes the target document identifier in the request parameters.
5. The OpenSign cloud function processes the request without enforcing session-based authentication or verifying the caller's identity.
6. The application responds with a JSON payload containing the complete document record, including signer emails, document metadata, and valid file download tokens.
7. Attacker parses the response to extract the download tokens.
8. Attacker uses the extracted download tokens to exfiltrate the full document content from the storage backend.

Impact

Successful exploitation allows unauthenticated actors to harvest sensitive PII and confidential documents managed within OpenSign. This can lead to unauthorized information disclosure, compromise of business contracts, and potential supply chain risk depending on the sensitivity of the signed documents.

Recommendation

1. Review current OpenSign document workflows and verify that OTP verification is mandated for all sensitive signing operations.
2. Monitor web server logs for anomalous patterns of requests to the 'getDocument' endpoint, particularly those originating from unauthorized or unexpected IP ranges or those lacking standard authentication headers.
3. Monitor for high volumes of individual document requests that deviate from typical user behavior patterns.
4. Upgrade OpenSign instances to a version beyond 2.41.3 as soon as vendor patches are available.