Form.io Path Handling Vulnerability Allowing Unauthorized Access to Protected API Endpoints

A vulnerability in Form.io's path handling has been identified, allowing unauthorized access to protected API endpoints. This issue affects Form.io versions 3.5.6 and earlier, as well as versions 4.0.0-rc.1 through 4.4.2. The vulnerability arises because an attacker can send a crafted request path that bypasses authentication or authorization, potentially leading to unauthorized data disclosure from protected endpoints.

Impact

Exploitation of this vulnerability could result in unauthorized access to protected API data, allowing for unauthorized data retrieval from secured endpoints.

Remediation

Users are advised to upgrade to Form.io version 3.5.7 or 4.4.3. For Form.io Server users, versions 8.5.8 and 9.4.3 are recommended.