A critical Insecure Direct Object Reference vulnerability in Agenzia Impresa Eccobook allows unauthenticated attackers to exfiltrate sensitive documents from the system.

The flaw exists within the PdfHandler component, where the application fails to perform adequate authorization checks on the DocumentoId parameter. This allows an unauthenticated attacker to bypass access controls and retrieve private files directly.

This vulnerability poses a significant risk to data confidentiality, as it enables unauthorized actors to access sensitive documentation without requiring valid credentials. Given the CVSS score of 7.5, this is classified as a high severity issue that could lead to the exposure of proprietary information or regulated data. Successful exploitation could result in severe reputational damage and potential regulatory non-compliance.

Immediate Action: Since a specific patch version is not currently identified, users should restrict access to the affected PdfHandler component via network-level controls until the vendor provides a security update.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous, sequential, or high-volume GET requests targeting the DocumentoId parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing suspicious DocumentoId patterns or unauthorized attempts to access document retrieval endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the CapgeminiCisRedTeam GitHub repository.

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running Eccobook version 2.81.1 or lower must prioritize the implementation of compensating controls and maintain close communication with the vendor to ensure the immediate application of security patches as soon as they become available.