starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-25 05:46:01 +03:00

[GH-ISSUE #1512] Documenso PDF Document Spoofing - Security Vulnerability #428

New issue

Closed

opened 2026-02-26 18:47:01 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 18:47:01 +03:00

Owner

Originally created by @kaerez on GitHub (Dec 5, 2024).
Original GitHub issue: https://github.com/documenso/documenso/issues/1512

Issue Description

CVE-2024-52271: User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.

Signed document
Documenso-Sec-MoU.pdf

Signing process
SCR-20241205-nqrj
SCR-20241205-nqph

Steps to Reproduce

PoC file is not publicly released.

Expected Behavior

Identify multiple layers and offer to flatten them or strip them, before editing and signing.
Ensure PDF is flattened before appending the digital signature and making the file available for download.

Current Behavior

Editor and signing UI abide by the PDF structure and configuration, and do not perform the expected behavior flattening.

Screenshots (optional)

Signed document, common view - attack is designed to do just that
SCR-20241205-nxcm

Signed document, print view - attack is designed to do just that
SCR-20241205-nxhf

Operating System [e.g., Windows 10]

N/R

Browser [e.g., Chrome, Firefox]

N/R

Version [e.g., 2.0.1]

app.documenso.com

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @kaerez on GitHub (Dec 5, 2024). Original GitHub issue: https://github.com/documenso/documenso/issues/1512 ### Issue Description CVE-2024-52271: User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. **Signed document** [Documenso-Sec-MoU.pdf](https://github.com/user-attachments/files/18023997/Documenso-Sec-MoU.pdf) **Signing process** <img width="1317" alt="SCR-20241205-nqrj" src="https://github.com/user-attachments/assets/90e2a2da-d111-4500-90a2-865a17051fcd"> <img width="1324" alt="SCR-20241205-nqph" src="https://github.com/user-attachments/assets/e93bb549-2cf9-4749-abee-baadcea0a501"> ### Steps to Reproduce PoC file is not publicly released. ### Expected Behavior 1. Identify multiple layers and offer to flatten them or strip them, before editing and signing. 2. Ensure PDF is flattened before appending the digital signature and making the file available for download. ### Current Behavior Editor and signing UI abide by the PDF structure and configuration, and do not perform the expected behavior flattening. ### Screenshots (optional) **Signed document, common view - attack is designed to do just that** <img width="1422" alt="SCR-20241205-nxcm" src="https://github.com/user-attachments/assets/adeb94ea-721a-4f1e-a412-4b5cc20054c2"> **Signed document, `print` view - attack is designed to do just that** <img width="1436" alt="SCR-20241205-nxhf" src="https://github.com/user-attachments/assets/12a54496-f32f-45cc-b090-b2fc2a7c79b7"> ### Operating System [e.g., Windows 10] N/R ### Browser [e.g., Chrome, Firefox] N/R ### Version [e.g., 2.0.1] app.documenso.com ### Please check the boxes that apply to this issue report. - [ ] I have searched the existing issues to make sure this is not a duplicate. - [ ] I have provided steps to reproduce the issue. - [ ] I have included relevant environment information. - [X] I have included any relevant screenshots. - [X] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [ ] I want to work on creating a PR for this issue if approved

kerem

2026-02-26 18:47:01 +03:00

closed this issue
added the
status: triage
label

kerem commented

2026-02-26 18:47:01 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Dec 5, 2024):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

@github-actions[bot] commented on GitHub (Dec 5, 2024): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

kerem commented

2026-02-26 18:47:02 +03:00

Author

Owner

@ElTimuro commented on GitHub (Dec 5, 2024):

@kaerez thanks for reporting. To clarify

Not flattening the layers before displaying allows for content spoofing?
Did you report this or only opened this issue from here https://nvd.nist.gov/vuln/detail/CVE-2024-52271 ?
I assume "DocuSeal" is a typo?

We will investigate this and take further steps.

@ElTimuro commented on GitHub (Dec 5, 2024): @kaerez thanks for reporting. To clarify - Not flattening the layers before displaying allows for content spoofing? - Did you report this or only opened this issue from here https://nvd.nist.gov/vuln/detail/CVE-2024-52271 ? - I assume "DocuSeal" is a typo? We will investigate this and take further steps.

kerem commented

2026-02-26 18:47:02 +03:00

Author

Owner

@kaerez commented on GitHub (Dec 5, 2024):

@kaerez thanks for reporting. To clarify

Not flattening the layers before displaying allows for content spoofing?

Did you report this or only opened this issue from here https://nvd.nist.gov/vuln/detail/CVE-2024-52271 ?

I assume "DocuSeal" is a typo?

We will investigate this and take further steps.

Hi @ElTimuro

Yes
Yes
Yeah, sorry :) - Fixed

@kaerez commented on GitHub (Dec 5, 2024): > @kaerez thanks for reporting. To clarify > > * Not flattening the layers before displaying allows for content spoofing? > * Did you report this or only opened this issue from here https://nvd.nist.gov/vuln/detail/CVE-2024-52271 ? > * I assume "DocuSeal" is a typo? > > We will investigate this and take further steps. Hi @ElTimuro 1. Yes 2. Yes 3. Yeah, sorry :) - Fixed

kerem referenced this issue

2026-02-26 19:31:16 +03:00

[PR #428] [CLOSED] chore(deps): bump next from 13.4.19 to 13.5.3 in /apps/marketing #970

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#428

No description provided.

Rows
Columns