Description

Frappe LMS version 2.40.0 contains an access control vulnerability where media files uploaded by instructors in assignment feedback comments are publicly accessible to unauthenticated users.

Instructor feedback on student submissions, including attached screenshots or documents, is stored under /files/ and can be accessed without authentication if the filename or URL is known or guessed.

Vulnerability Details

The LMS provides a comment/feedback feature on assignment submissions, where instructors can leave comments and attach media files. These files are:

• Uploaded by instructors through the assignment submission view.
• Stored under the publicly accessible /files/ path.
• Not protected by authentication or authorization checks.

Because this area directly relates to student submissions and instructor evaluation, the exposed content may include:

• Student assignment content and work.
• Grading feedback.
• Screenshots, documents, or other sensitive material.

Steps to Reproduce

1. Log in as an instructor and create course and assignment.

   • Go to courses: /lms/courses
   • Create a course: COURSE_NAME.
   • Go to assignments: /lms/assignments
   • Create an assignment (e.g. type Text).

2. Attach the assignment to a course lesson.

   • Edit the course:
     /lms/courses/COURSE_NAME/edit
   • In the right sidebar, click "Add lesson" and open:
     /lms/courses/COURSE_NAME/learn/1-2/edit
   • In the lesson content, insert the assignment you created.

3. Submit the assignment as a student.

   • Log in as a student.
   • Enroll into COURSE_NAME.
   • Submit any response to the assignment within the course.

4. Leave instructor feedback with an attachment.

   • Log back in as an instructor.
   • Go to /lms/assignments and click the assignment attached to COURSE_NAME.
   • In the modal, click "Check submissions", opening:
     /lms/assignment-submissions?assignmentID=ASG-00003 (example).
   • Click on a specific submission, leading to:
     /lms/assignment-submission/ASG-00003/ASG-SUB-00006 (example).
   • On the right sidebar, add a comment and upload a media file.

5. Access the uploaded media without authentication.

   • Note the media URL under /files/, e.g.:
     http://localhost:8000/files/feedback_image.png
   • Log out or use an unauthenticated browser window.
   • Open the /files/feedback_image.png URL directly.
   • The media is accessible without any login or permission checks.

Impact

• Student privacy breach: Feedback and associated media may expose student performance, work quality, or sensitive context shared with instructors.
• Information disclosure: Internal evaluation notes, screenshots, or documents can be accessed by anyone who discovers the URL.
• Regulatory/compliance concerns: In some environments, instructor feedback on students may be considered educational records subject to privacy regulations.

The impact is primarily on confidentiality, but the sensitive context of instructor feedback makes this more severe than generic media exposure.

Recommendation

• Enforce authentication and authorization checks on all media associated with assignment feedback and comments.
• Store instructor feedback media in protected storage, checking:
  • Ownership of the submission.
  • Role (instructor vs. student).
  • Course/assignment visibility and enrollment status.
• Avoid using a globally public /files/ endpoint for sensitive content; instead, serve files through an authenticated view that validates permissions.
• Optionally, use signed, expiring URLs tied to authorized users.