| Название | NonceGeek dim-sum-app up to d7f818d8c829260e9a66e8dec2793ae86572bf2a Server-Side Request Forgery |
|---|
| Описание | An unauthenticated server-side request forgery vulnerability was identified in the Deno backend of NonceGeek dim-sum-app.
The vulnerability affects the textSearchV2Handler function exposed through the GET /v2/text_search endpoint and its /text_search_v2 alias. The handler accepts a user-controlled supabase_url query parameter without validation or an allowlist.
When the supplied URL differs from the configured SUPABASE_URL, the application creates a new Supabase client for the attacker-controlled URL using the server-side SUPABASE_SERVICE_ROLE_KEY. The application then invokes the search_cantonese_corpus RPC through this client. The supabase-js client includes the service-role credential in both the apikey and Authorization request headers. Consequently, an unauthenticated remote attacker can cause the application to transmit its Supabase service-role credential to an attacker-controlled HTTP server.
The disclosed service-role credential bypasses Supabase Row Level Security and may allow unauthorized reading, modification, or deletion of application data. Depending on the deployment, this may expose user information, authentication tokens, platform API credentials, verification codes, corpus data, audit records, and administrative data. It may also allow compromise of application administrator accounts and management functionality.
The vulnerable functionality was introduced in git commit 9db0cd53295473d89d042fad579b0508dd98f467. The project does not publish formal versioned releases. Source builds containing the vulnerable implementation up to commit d7f818d8c829260e9a66e8dec2793ae86572bf2a are affected.
The vulnerability was fixed in commit 8389032e5d52c28c4855c6126ca7d0eae8af346a by removing the user-controlled supabase_url parameter and always using the application's configured Supabase client.
The vulnerability can be exploited remotely without authentication or user interaction. The vendor acknowledged the report and confirmed that the issue was fixed.
Discovered and reported by dkhonker. |
|---|
| Источник | ⚠️ https://github.com/NonceGeek/dim-sum-app/issues/366 |
|---|
| Пользователь | dkhonker (UID 100815) |
|---|
| Представление | 26.08.2026 04:50 (25 дни назад) |
|---|
| Модерация | 19.09.2026 22:44 (25 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 407967 [NonceGeek dim-sum-app Deno Backend deno/main.tsx textSearchV2Handler supabase_url эскалация привилегий] |
|---|
| Баллы | 20 |
|---|