Listen to this Post
The `POST /api/v1/knowledge-bases/copy` endpoint enqueues an asynchronous task to clone a knowledge base (KB) using a caller-supplied `source_id` without verifying tenant ownership. The handler creates a `KBClonePayload` containing the attacker’s `TenantID` and the unverified SourceID. This task is then processed by ProcessKBClone, which calls the `CopyKnowledgeBase` service method. This service method retrieves the source KB by calling the repository function GetKnowledgeBaseByID(ctx, srcKB). The repository method performs a raw database query filtering only by id, completely ignoring the `tenant_id` column. Because the lookup is not scoped to the tenant, it returns the victim’s KB from any tenant. The service then proceeds to create a new KB under the attacker’s tenant, shallow-copying all configurations, documents, and FAQ entries from the victim’s knowledge base. This results in a complete cross-tenant data exfiltration. The root cause is the lack of tenant isolation in the data access layer, which fails to append a `WHERE tenant_id = ?` clause to the query.
Platform: Unspecified
Version: Unspecified
Vulnerability: Cross-tenant IDOR
Severity: Critical
date: 2026-03-06
Prediction: Patch within 30 days
What Undercode Say:
Analytics:
The vulnerability lies in the data access layer’s failure to enforce tenant isolation.
Vulnerable Code Pattern (internal/application/repository/knowledgebase.go):
func (r knowledgeBaseRepository) GetKnowledgeBaseByID(ctx context.Context, id string) (types.KnowledgeBase, error) {
var kb types.KnowledgeBase
// ERROR: Query filters only by ID, allowing cross-tenant reads.
if err := r.db.WithContext(ctx).Where("id = ?", id).First(&kb).Error; err != nil {
return nil, err
}
return &kb, nil
}
Corrected Code (Tenant-Aware):
func (r knowledgeBaseRepository) GetKnowledgeBaseByID(ctx context.Context, id string) (types.KnowledgeBase, error) {
var kb types.KnowledgeBase
tenantID := ctx.Value(types.TenantIDContextKey).(uint64) // Extract tenant from context
// SECURE: Query filters by both ID and Tenant ID.
if err := r.db.WithContext(ctx).Where("id = ? AND tenant_id = ?", id, tenantID).First(&kb).Error; err != nil {
return nil, err
}
return &kb, nil
}
Exploit Proof of Concept (cURL):
Precondition: Authenticate as Tenant A and obtain a valid token.
Replace <VICTIM_KB_UUID> with a target knowledge base ID from Tenant B.
curl -X POST http://localhost:8088/api/v1/knowledge-bases/copy \
-H "Authorization: Bearer <ATTACKER_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"source_id":"<VICTIM_KB_UUID>","target_id":""}'
Expected success response: HTTP 200 OK with a task_id.
The new knowledge base will appear in Tenant A's list after async completion.
How Exploit:
- Reconnaissance: Attacker obtains a valid victim Knowledge Base UUID (via guessing, OSINT, or previous breach).
- Authentication: Attacker authenticates to their own tenant (Tenant A) to get a valid session token.
- Request Forgery: Attacker sends a POST request to the `/api/v1/knowledge-bases/copy` endpoint, placing the victim’s UUID in the `source_id` field.
- Bypass: The backend accepts the request, fetches the victim’s KB by ID without checking tenant ownership.
- Exfiltration: The system creates a duplicate of the victim’s KB under the attacker’s tenant, copying all documents and configurations.
Protection from this CVE:
- Enforce Tenant Context in Repositories: Modify all repository `GetByID` functions to automatically include a `tenant_id` filter derived from the user’s context.
- Input Validation: Implement ownership checks in the service layer before any read or copy operation. Verify that the `source_id` belongs to the same tenant as the requester.
- Parameterized Queries: Use structured query builders that force tenant scoping (e.g.,
repo.GetKnowledgeBase(ctx, id, tenantID)). - Audit and Monitoring: Monitor for unusual patterns where a single tenant initiates multiple “copy” operations targeting different tenant prefixes.
Impact:
- Critical Data Breach: An attacker can exfiltrate entire knowledge bases, including proprietary documents, FAQ entries, and internal configuration data from any tenant.
- Broken Access Control: This vulnerability completely nullifies tenant isolation, allowing a user from one organization to steal data from a competitor or another customer on the same platform.
- Business Logic Bypass: The copy operation proceeds even if the source KB references models (e.g., embedding models) that do not exist in the attacker’s tenant, indicating a lack of integrity checks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
