photoprism-unauth-exposure: PhotoPrism - Unauthenticated Exposure

id: photoprism-unauth-exposure

info:
  name: PhotoPrism - Unauthenticated Exposure
  author: pussycat0x
  severity: high
  description: |
    PhotoPrism instance is running in public mode with authentication disabled (PHOTOPRISM_AUTH_MODE=public), exposing all photos, albums, GPS locations, face recognition data, and server configuration to unauthenticated users.
  reference:
    - https://docs.photoprism.app/getting-started/config-options/#authentication
    - https://docs.photoprism.app/getting-started/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 1
    vendor: photoprism
    product: photoprism
    shodan-query: title:"PhotoPrism"
    fofa-query: title="PhotoPrism"
    google-query: intitle:"PhotoPrism" inurl:"/library/browse"
  tags: photoprism,exposure,unauth,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/config"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "PhotoPrism"
          - "\"public\":true"
          - "\"authMode\":\"public\""
        condition: and

      - type: word
        part: header
        words:
          - "application/json"
# digest: 4b0a00483046022100ace9a83c9dbae9c74225452a5bc00c318ec150b5919ecb07cd6db0f47b354388022100b514a27dd31c5c6f9a7ea371ddd4396726b0174c6ec50e8065d59a3d8a20dea0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.