Untitled

Title: CVE-2024-39033 - Insecure Direct Object Reference in Newgensoft OmniDocs

==========================================
[Description]
In Newgensoft OmniDocs 11.0_SP1_03_006, an Insecure Direct Object Reference (IDOR) vulnerability in the `getuserproperty` function allows users' configuration and Personally Identifiable Information (PII) to be stolen.

------------------------------------------
[Additional Information]
This vulnerability was discovered during authorized penetration testing. The vendor has fixed the vulnerability in a newer version. Our company uses the OmniDocs application.

------------------------------------------
[Vulnerability Type]
Incorrect Access Control

------------------------------------------
[Vendor of Product]
Newgensoft

------------------------------------------
[Affected Product Code Base]
- Affected Version: OmniDocs 11.0_SP1_03_006
- Fixed Version: OmniDocs 11.0_SP1_03_016

------------------------------------------
[Affected Component]
Insecure Direct Object Reference (IDOR) vulnerability in the `getuserproperty` function. The `ID` parameter sent in the JSON payload is vulnerable.

**Vulnerable URI**:
/omnidocs/controllerservlet?requestcall=Component.OmniDocsAdmin.Users.GetUserProperty


------------------------------------------
[Attack Type]
Remote

------------------------------------------
[Impact Information Disclosure]
true

------------------------------------------
[Attack Vectors]
The attack vector is through the network. Any user can replace their `ID` in the request to access other users' configuration and PII information.

------------------------------------------
[References]
1. https://newgensoft.com/platform/content-services-platform/content-workdesk/
2. https://appsource.microsoft.com/en-us/product/web-apps/newgensoftware-2272900.omnidocs?tab=PlansAndPrice
3. https://www.cvedetails.com/vulnerability-list/vendor_id-10557/product_id-18863/Newgensoft-Omnidocs.html

------------------------------------------
[Discoverer]
Individual
✅ Leaked Exploit Documentation:

https://rawtext.host/raw?44lh4m

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without any verification from Swapzone — instant swap).