khoj up to 1.29.9 /api/subscription update_subscription email authorization

Summaryinfo

A vulnerability was found in khoj up to 1.29.9. It has been declared as problematic. This affects the function update_subscription of the file /api/subscription. Executing a manipulation of the argument email can lead to authorization. This vulnerability is tracked as CVE-2024-52294. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in khoj up to 1.29.9. This vulnerability affects the function update_subscription of the file /api/subscription. The manipulation of the argument email with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect integrity. CVE summarizes:

Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. The vulnerability exists in the subscription endpoint at `/api/subscription`. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription. The issue was fixed in version 1.29.10. Support for arbitrarily presenting an email for update has been deprecated.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-52294 since 11/06/2024. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.29.10 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• khoj

Version

• 1.29.0
• 1.29.1
• 1.29.2
• 1.29.3
• 1.29.4
• 1.29.5
• 1.29.6
• 1.29.7
• 1.29.8
• 1.29.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion