When File References Become a Weapon Exploiting Trust Between Anonymous Sessions

Modern web applications often rely on temporary identifiers and backend references to manage uploaded documents. However, when these references are not properly tied to the session that created them, they can become a serious security weakness. During a security assessment, I identified a broken access control vulnerability that allowed an anonymous session to process and delete a document uploaded by an entirely different anonymous session. The underlying issue was a lack of ownership verification during document processing and deletion operations. Technical Analysis The application exposed backend operations responsible for processing document identifiers and executing deletion requests. The vulnerable workflow involved two operations: processFileIds deleteContentDocProcessed The first operation accepted a document identifier and returned an encoded reference. The second accepted that reference and executed the deletion without verifying that the requesting session owned the original document. Reproduction Commands The following JavaScript example illustrates the structure of a controlled test document: const filename = `security-test-${Date.now()}.txt`; const file = new File( ["Controlled security assessment document"], filename, { type: "text/plain" } ); console.log("Test file created:", file.name); To inspect the document identifier returned by the upload operation: const documentId = "069xxxxxxxxxxxx"; console.log("Document ID:", documentId); The backend processing operation could then be represented as: { "classname": "IDR_ContentDocumentUtil", "method": "processFileIds", "params": { "fileIds": ["069xxxxxxxxxxxx"] } } The returned opaque reference was subsequently accepted by the deletion operation: { "classname": "IDR_ContentDocumentUtil", "method": "deleteContentDocProcessed", "params": { "conDocId": "" } } These examples illustrate the vulnerable operation structure; they are not standalone executable requests. Security Impact An unauthenticated attacker who obtains a valid document identifier could potentially delete files belonging to other anonymous sessions. This could result in: Unauthorized document deletion. Loss of important supporting evidence. Disruption of critical submission workflows. Compromise of document integrity. Root Cause and Remediation The primary weakness was the absence of proper ownership validation between the uploaded document, its originating transaction, and the session requesting its deletion. The recommended solution is to enforce server-side authorization checks at every stage, bind documents to their original upload context, and reject deletion requests that cannot demonstrate valid ownership. Classification: Insecure Direct Object Reference (IDOR) / Broken Access Control. Final Observation: Identifiers are references, not permissions. Every document operation must independently verify authorization, regardless of whether the request originates from an authenticated or anonymous session.