Enno Gelhaus

Postiz fails to verify that media paths not formatted as web addresses are located within the designated upload directory. This allows a registered user to provide a crafted media path that enables the publishing worker to read arbitrary files from the server's disk and send them as attachments to an external Discord server. Additionally, two other routes allow for similar unconfined reads: one that confirms file existence and can lead to backend memory exhaustion, and another that delivers the file. Since self-registration is enabled by default, an attacker can create an account to exploit these issues.

Postiz uses a single shared secret to sign session, invitation, and password reset tokens without including a marker to distinguish the token purpose. A route used to refresh browser-extension channel credentials signs data provided in the request and stores the result for the user to retrieve. This allows a user to forge a validly signed token with arbitrary claims, which the application may accept as a session token, an organization invitation with a specific role, a password reset token, or an enterprise provisioning token. Additionally, a route for creating team invitations signs extra fields from the request body using the same flawed mechanism.

Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper functions not intended for web interface access. One such helper enables the reading of arbitrary files from the server disk if a channel is connected using a file path as a token, potentially exposing environment variables, session signing secrets, database addresses, and service credentials. Additionally, another helper function can be used to force the backend process to exit, causing a denial of service. Since self-registration is enabled by default, these actions can be performed by any newly registered user.

Several endpoints return complete database rows instead of specific required fields, leading to the exposure of sensitive secrets. The channel delete endpoint returns the deleted integration row, which includes the platform access token and refresh token, allowing a third-party OAuth app to obtain social platform credentials. Additionally, the `GET /user/organizations` endpoint returns the organization row including the API key to all members, enabling users with lower roles to obtain the key intended for admins and call the public API on behalf of the organization. Access to these endpoints requires a valid session, API key, or OAuth token and is restricted to the caller's own organization.

Postiz uses `Math.random()` instead of a cryptographically secure source to generate security-sensitive credentials. This affects OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, which rely on the deterministic xorshift128+ PRNG (Pseudo-Random Number Generator) state of the V8 engine. An unauthenticated attacker can use a dynamic client registration endpoint to obtain consecutive PRNG outputs and reconstruct the internal state. This allows the attacker to deterministically derive past and future values, potentially compromising credentials of other users and organizations.

An HTTP endpoint used for provisioning enterprise and reseller organisations is accessible without a session because the authentication middleware does not include the enterprise controller in its list of protected controllers. The endpoint only verifies that the request body contains a token signed with the instance secret but fails to validate the token's purpose, audience, or expiry. Consequently, a standard user session token can be used to bypass authentication. Successful exploitation allows an attacker to create a new organisation with the highest subscription tier, a lifetime flag, and an excessive channel allowance, while also creating an organisation-owner account and obtaining a valid API key for the public API.

An unauthenticated remote attacker can perform an arbitrary file read by exploiting a path traversal issue in the route that serves locally stored media. The application joins URL-supplied path segments to the upload directory and streams the file without normalizing the path or confining it to the directory. While raw dot-segments are collapsed before routing, URL-encoded separators survive route matching and are decoded at the handler, enabling traversal during the filesystem call. This allows access to any file readable by the application process, including the process environment, which exposes the database connection string, connected provider and billing secrets, and the JWT (JSON Web Token) signing secret. Since session tokens are signed with this secret and lack an expiry date, an attacker can forge a non-expiring session for any user, including administrators, without a password. The affected endpoint is '/uploads'.

A flaw in the billing and license activation subsystem enables remote, unauthenticated attackers to bypass payment authorization workflows. The issue stems from insufficient cryptographic validation or a lack of server-side state verification regarding promotional and lifetime-deal (LTD) redemption codes. This allows attackers to forge valid redemption tokens or replay single-use codes to activate the highest-tier paid subscriptions without completing a financial transaction.