## Summary
zlt2000 microservices-platform (through 6.0.0) contains an authorization bypass in the file-center module. An authenticated attacker can call DELETE /files/{id} without ownership validation, enabling deletion of other users’ files/metadata after enumerating identifiers via GET /files.
## Technical Details
- Vulnerable component: zlt-business/file-center (FileController.java in com.central.file.controller)
- Affected endpoint: DELETE /files/{id}
- Root issue (per NVD): endpoint performs no ownership validation (authorization bypass / CWE-639)
- Attack prerequisites (per NVD):
- Authenticated access (PR:L, UI:N)
- Ability to enumerate file identifiers using GET /files
- Exploit technique (from PoC reference): a request script targets arbitrary file deletion by supplying a chosen {id} to the delete endpoint (see cve-request-poc/.../C19_delete_any_file.py).
- PoC availability: a dedicated PoC script exists in the referenced repository.
## Affected
- zlt2000/microservices-platform versions: through 6.0.0
- Module: file-center
- Controller: com/central/file/controller/FileController.java
## Impact
- Unauthorized deletion of arbitrary users’ files and metadata via DELETE /files/{id}
- Identifier enumeration enables targeted abuse after GET /files
- Likely consequences include integrity and availability impact for affected users’ stored artifacts (NVD indicates I:H and A:H).
## Mitigation
1. Patch/upgrade microservices-platform to a version that fixes the missing ownership validation in file-center’s DELETE /files/{id}.
2. Enforce authorization checks server-side to verify the authenticated principal owns (or is permitted to manage) the target file {id} before deletion.
3. Add monitoring/alerting for abnormal patterns: repeated GET /files followed by DELETE /files/{id} across many IDs from the same account/session.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-639