CVE-2022-30852

Known is a social publishing platform for groups and individuals [1]. In version 1.3.1, an Insecure Direct Object Reference (IDOR) vulnerability exists [2]. IDOR occurs when an application exposes direct references to internal objects, such as database keys or file paths, without proper access control checks, enabling attackers to manipulate these references to access unauthorized data [2].

An attacker can exploit this vulnerability by modifying object references in URLs, form parameters, or API calls. The attack does not necessarily require authentication if the vulnerable endpoint is publicly accessible. The specific attack surface depends on which objects are referenced directly; common targets include user profiles, posts, or media files [2].

Successful exploitation could allow an attacker to view, modify, or delete content belonging to other users, potentially leading to data exposure, privilege escalation, or account takeover. The exact impact is determined by the privileges of the affected object and the functionality exposed [2].

As of the publication date, no official patch has been confirmed for version 1.3.1. Users are advised to upgrade to a newer version of Known if available, or apply workarounds such as implementing proper access control checks. A blog post detailing multiple vulnerabilities in Known, including this IDOR, is referenced in the NVD entry [2]. The official Known website provides general information about the platform [3].