Listen to this Post
The vulnerability is caused by missing authentication decorators in three FastAPI endpoints within monitor.py. The `dependencies=[Depends(get_current_active_user)]` parameter is absent from the route definitions for GET /api/v1/monitor/messages, GET /api/v1/monitor/transactions, and DELETE /api/v1/monitor/messages/session/{session_id}. This omission allows the associated functions to execute without validating the user’s identity or permissions. The FastAPI framework does not enforce authentication on these endpoints, treating them as publicly accessible. Consequently, any HTTP request reaching the server for these paths is processed, leading to unauthorized data exposure or destruction. The flaw is highlighted by contrasting it with other correctly secured endpoints in the same file that include the necessary dependency injection, demonstrating an inconsistency in the authorization logic.
Platform: Langflow
Version: up to 1.5.0
Vulnerability: Broken Authentication
Severity: Critical
date: 2024-05-15
Prediction: 2024-05-15
What Undercode Say:
curl http://localhost:7860/api/v1/monitor/messages
curl “http://localhost:7860/api/v1/monitor/transactions?flow_id=00000000-0000-0000-0000-000000000000”
curl -X DELETE http://localhost:7860/api/v1/monitor/messages/session/00000000-0000-0000-0000-000000000000
dependencies=[Depends(get_current_active_user)]
How Exploit:
Unathenticated API requests.
Data extraction queries.
Unathenticated DELETE calls.
Protection from this CVE
Add authentication dependency.
Update to v1.5.1.
Review endpoint security.
Impact:
Unauthorized data access.
Privacy violation.
Data destruction.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
