Pbc

Postiz fails to verify that media paths not formatted as web addresses are located within the designated upload directory. This allows a registered user to provide a crafted media path that enables the publishing worker to read arbitrary files from the server's disk and send them as attachments to an external Discord server. Additionally, two other routes allow for similar unconfined reads: one that confirms file existence and can lead to backend memory exhaustion, and another that delivers the file. Since self-registration is enabled by default, an attacker can create an account to exploit these issues.

Postiz uses a single shared secret to sign session, invitation, and password reset tokens without including a marker to distinguish the token purpose. A route used to refresh browser-extension channel credentials signs data provided in the request and stores the result for the user to retrieve. This allows a user to forge a validly signed token with arbitrary claims, which the application may accept as a session token, an organization invitation with a specific role, a password reset token, or an enterprise provisioning token. Additionally, a route for creating team invitations signs extra fields from the request body using the same flawed mechanism.

Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper functions not intended for web interface access. One such helper enables the reading of arbitrary files from the server disk if a channel is connected using a file path as a token, potentially exposing environment variables, session signing secrets, database addresses, and service credentials. Additionally, another helper function can be used to force the backend process to exit, causing a denial of service. Since self-registration is enabled by default, these actions can be performed by any newly registered user.