Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
docusealco/docuseal
master @ cabfe45
36
Fixes
1
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 13 prior fixes. Scrutinize any change in this area.
app/controllers/api/active_storage_blobs_proxy_controller.rb: most-fixed (3 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The application struggled with signed ID reuse across different scopes and missing authorization checks on ActiveStorage blobs, allowing unauthorized file downloads. Key mitigations required enforcing purpose-specific signature validation and disabling default ActiveStorage routes.
SSRF: File download and template upload flows did not strictly validate external URIs, exposing internal services to server-side request forgery (SSRF). This was fixed by implementing scheme and host validation limits using Addressable::URI.
Insecure File Upload: Lack of strict MIME-type and extension validation on upload parameters allowed potentially dangerous files to be written directly to the storage engine via ActiveStorage.