[pentest] DELETE /api/pastes/{id} performs deletion without any authentication or deletion token #63

Closed
opened 2026-09-09 14:10:09 +00:00 by poslop · 0 comments
Owner

DELETE /api/pastes/{id} deletes a paste even when no token and no credentials are supplied. Providing a wrong deletion_token in the JSON body also succeeds (returns {"status":"soft-deleted"}). The deletion token issued at create time is never validated.

Repro (verified):

  • curl -X DELETE https://<host>/api/pastes/<id> -> 200 {"status":"soft-deleted"}, paste gone (404 afterwards)
  • curl -X DELETE -d '{"deletion_token":"totally-wrong"}' https://<host>/api/pastes/<id> -> 200, paste gone
  • Deleting with header Origin: https://evil.example also succeeds -> no CSRF protection either.

Impact: any visitor can permanently soft-delete any paste by ID; IDs are short (6 chars) and enumerated via /api/public. Cross-site deletion is possible (no SameSite=Strict, no CSRF token).

`DELETE /api/pastes/{id}` deletes a paste even when **no token and no credentials are supplied**. Providing a wrong `deletion_token` in the JSON body also succeeds (returns `{"status":"soft-deleted"}`). The deletion token issued at create time is never validated. Repro (verified): - `curl -X DELETE https://<host>/api/pastes/<id>` -> 200 `{"status":"soft-deleted"}`, paste gone (404 afterwards) - `curl -X DELETE -d '{"deletion_token":"totally-wrong"}' https://<host>/api/pastes/<id>` -> 200, paste gone - Deleting with header `Origin: https://evil.example` also succeeds -> no CSRF protection either. Impact: any visitor can permanently soft-delete any paste by ID; IDs are short (6 chars) and enumerated via /api/public. Cross-site deletion is possible (no SameSite=Strict, no CSRF token).
Sign in to join this conversation.