Insecure Direct Object Reference in Private File Uploads

Problem/Motivation

This was originally reported as a private security issue but cleared by the security team for a public issue

Imagine there is a file with fid 999, uploaded to a Group. FID's are incremental, so one could easily guess this.
Now an attacker logs in, and is able to add files to content.
The code in core/modules/file/src/Element/ManagedFile.php allows to guess the file id and attach the specific file with the node.

Steps to reproduce

1. Install Drupal with the Standard profile.
2. Set up the private files ($settings['file_private_path'] in settings.php).
3. Grant the permissions Create report content, View own unpublished content, and Administer node published status to the Content editor role.
   Verify that it does not have the permission Bypass content access control.
4. Create two users with the Content editor role.
5. Create a content type named report with a file field named field_attachment.
   • Configure the file field to use the private files upload destination.
   • Set the cardinality to Unlimited.
6. As a user with the Content editor role:
   1. Create a node of type report.
   2. Upload a file named test_1.txt to the field_attachment field.
   3. Mark the node as unpublished.
   4. Save the node.
7. As another user with the Content editor role:
   1. Visit the node creation form for the report content type.
   2. Open the browser developer tools.
   3. Edit the <input> element with the attribute name="field_attachment[0][fids]".
   4. Add the attribute value="1" (increment the value and retry if the following steps do not reveal the issue).
   5. Upload another file named test_2.txt using the field_attachment field.
   6. After the AJAX upload completes, the widget displays both test_1.txt and test_2.txt.

Proposed resolution

Add the validation in ManagedFile::valueCallback() element to check that user has download access of the file using $file->access('download').

Remaining tasks

Needs fix

User interface changes

N/A

Introduced terminology

N/A

API changes

N/A

Data model changes

N/A

Release notes snippet

N/A