Executive brief
Mogu Blog v2 is a self-hosted blogging platform that manages file storage and quotas for users. An unauthenticated attacker can remotely manipulate storage quota allocations for administrator accounts, potentially causing service disruption or unauthorized storage expansion without needing valid login credentials.
Technical details
A missing authentication vulnerability exists in the storage management endpoints (/storage/initStorageSize and /storage/editStorageSize) of Mogu Blog v2 due to improper Spring Security configuration that uses permitAll() for /storage/** endpoint patterns. The vulnerable component (StorageRestApi.java and StorageServiceImpl.java) fails to validate user identity before processing storage quota modification requests. An unauthenticated attacker can send network requests to these endpoints to arbitrarily modify storage quotas assigned to any administrator account, achieving denial of service or unauthorized resource expansion. The exploit is publicly available and no vendor patch has been provided despite early notification.
Affected products
- moxi159753 Mogu Blog v2 up to 5.2
Timeline
- 2025-12-01: disclosed
- other: Exploit publicly available; vendor did not respond to early notification