Description

Frappe LMS version 2.40.0 contains an access control vulnerability where media files uploaded by instructors to assignments are publicly accessible to unauthenticated users.

While media uploaded by students to assignments is stored as private, instructor-uploaded media is stored under the /files/ path and can be accessed by anyone who knows or guesses the file URL.

Vulnerability Details

The application applies inconsistent access control to assignment media uploads:

• Student uploads are treated as private.
• Instructor uploads within assignment questions are stored under /files/ and are accessible without authentication.

This allows an unauthenticated attacker to retrieve potentially sensitive teaching material or internal resources by directly requesting the file path or fuzzing filename patterns.

Steps to Reproduce

1. Log in as an instructor.

   • Navigate to the assignments page:
     http://localhost:8000/lms/assignments

2. Create a new assignment.

   • Click the "Create" button in the top-right corner.
   • In the assignment creation modal, locate the question text area.

3. Upload media in the question field.

   • Use the media upload/browse functionality in the question editor.
   • Upload an image or other media file.
   • Observe that the file is stored under a URL like:
     http://localhost:8000/files/faj.png

4. Access the file without authentication.

   • Log out of the application (or use a private browser window).
   • Directly open the file URL, for example:
     http://localhost:8000/files/faj.png
   • The media is still accessible, despite no active session.

Impact

• Information disclosure: Internal teaching materials, assignment content, hints, or embedded resources uploaded by instructors can be accessed by unauthenticated users.
• Loss of confidentiality: Assignment wording or example material meant only for enrolled students or specific cohorts becomes globally accessible.
• Reconnaissance: An attacker can fuzz or brute-force /files/ to enumerate other private resources uploaded by instructors.

While the impact is primarily on confidentiality, the risk is increased by the lack of authentication for the /files/ endpoint and the predictability of filenames.

Recommendation

• Enforce authentication and authorization checks on all media endpoints under /files/.
• Store assignment-related media in a protected storage layer where access is checked against:
  • Course enrollment
  • Assignment visibility
  • User role (student/instructor/admin)
• Avoid relying on predictable or user-controlled filenames for access control.
• Consider using signed, time-limited URLs for file access, tied to the current user session and permissions.