Security: Task Result API IDOR + Enterprise App Download Missing Authentication

[lighthousekeeper1212]

Summary

A security audit identified 2 vulnerabilities (1 High, 1 Medium) in Zentral.

High: Task Result API IDOR -- Cross-User Data Access

File: server/base/api_views.py, lines 20-46 (TaskResultView) and 49-77 (TaskResultFileDownloadView)
Endpoints: GET /api/task_result/<uuid>/ and GET /api/task_result/<uuid>/download/

The TaskResultView and TaskResultFileDownloadView authenticate users but perform no authorization check on task result ownership. Any authenticated user can read or download ANY user's task result by knowing the task UUID.

The web views (server/accounts/views/tasks.py) correctly scope results:

# Web view - CORRECT: scopes by user
if not self.request.user.is_superuser:
    queryset = queryset.filter(usertask__user=self.request.user)

# API view - MISSING: no user scoping
task_result = TaskResult.objects.get(task_id=task_id)  # Any user's task

Your own tests confirm the intended isolation model (test_view_task_deny expects 404 for cross-user access).

Impact: Task results contain sensitive data: inventory exports, machine snapshots, installed application lists, osquery results, Santa target exports.

Fix: Add usertask__user=request.user filtering for non-superusers in the API views, matching the web view pattern.

Medium: Enterprise App Download Missing Authentication

File: zentral/contrib/mdm/public_views/mdm.py, lines 579-597
Endpoint: public/mdm/device_commands/<uuid>/enterprise_app/

The EnterpriseAppDownloadView serves enterprise app packages with zero authentication. This is already acknowledged via # TODO limit access comment. Other download views (ACMECredential, SCEPCredential, DataAsset, Profile) all use Django signing framework with time-limited tokens. This one uses only a bare UUID.

Fix: Use Django's signing framework to generate time-limited download tokens, matching the pattern used by other download views.

---

Reported responsibly to help improve application security.