wger Workout Manager Insecure Direct Object Reference Vulnerability Allowing Unauthorized Access to Private User Data

An insecure direct object reference (IDOR) vulnerability has been identified in wger, a workout and fitness management application, in versions prior to 2.6. This vulnerability allows any authenticated user to access another user's private workout session notes, exercise history, and training statistics. The issue arises in the RoutineViewSet, where the /logs/ and /stats/ actions mistakenly grant access to the owner's private data from routines marked as public templates, regardless of ownership. This exploitation can lead to unauthorized access to sensitive health-related information, violating privacy regulations such as GDPR.

Impact

Exploitation of this vulnerability allows authenticated users to read private workout notes, exercise logs, and training statistics of other users, as long as the targeted user has a public template routine. This access to personal health data constitutes a breach of privacy regulations.

Reproduction

To reproduce this vulnerability, an authenticated user can first enumerate public template routines using the routine listing endpoint. Once a routine owned by another user is identified, the attacker can invoke the /logs/ or /stats/ actions on that routine. The response will include the owner's private workout history or training statistics, instead of the attacker's, thereby demonstrating the unauthorized access granted by the vulnerability.

Remediation

Users can update to wger version 2.6 or later, where this vulnerability has been fixed.