Abstract
Anyone can access the university transcript for some students in the Universitat de Barcelona, given that they know their NIUB and the degree they are coursing.
Reproduction steps
- Get the NIUB of a UB student.
- Go to the UB degrees directory, and click on the degree that the student is coursing. When accessing the page for that degree, in the URL a code beginning with the letter "G" and 4 numbers will appear. That's the code corresponding to that degree, take note of that.
- Now, access http://www2.giga.ub.edu/acad/XAutoConsulta/treball/{year}_{niub}_{degree}_.pdf, where {year} is a year (it seems to be more or less the year in which the transcript was last updated), {niub} is the student's NIUB, and {degree} is the degree code that can be found following step 2. This doesn't always work, so to reproduce this you might have to try with different values of {year}, and even then, I suppose if the student hasn't checked their transcript ever, it might not be available.
To bring proof of exploitability, here is a URL which shows my transcript: http://www2.giga.ub.edu/acad/XAutoConsulta/treball/2018_[REDACTED]_G1035_.pdf
Severity of the vulnerability
Several things have to be taken into account:
- NIUB numbers can be easily found (by searching [niub física] in Google, for example, in the information panels at the university), and by doing the previous things, it is also easy to match the students to the degree they are coursing.
- Viewing the transcripts reveals the student's name, DNI and marks.
- The PDFs can be accessed without even logging in.
- From a few tests, I could see that this doesn't always work and it may require trial and error, but in the cases it works, it displays too much information.
What should be done?
An access control should be implemented. Basically, a student should have access only to their transcript, and no one else should have access (obviously with the exception of administrators). Apart, it shouldn't allow access to people who are not logged in.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.