CVE-2024-55604

Executive Summary

CVE-2024-55604 is an information disclosure vulnerability in Appsmith, a platform for building admin panels, internal tools, and dashboards. The vulnerability allows users with the "App Viewer" role to enumerate datasources within a workspace they are a member of. This exposure does not include sensitive data such as database passwords or API keys, but it does leak the existence and configuration details of datasources. The attack requires the attacker to have been invited as a viewer to a workspace and to be able to sign up or log in to the Appsmith instance. The issue is patched in version 1.51.

Supply Chain & Package Security

Appsmith is a self-hosted or cloud-based platform. The vulnerability affects the application logic itself, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Appsmith should ensure they are running version 1.51 or later to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector provided)
• Attack Vector (AV): Network (attacker must be able to access the Appsmith instance)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): Low (attacker needs "App Viewer" role)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): Low (disclosure of datasource existence, not credentials)
• Integrity (I): None
• Availability (A): None
• Threat Level: Medium (information disclosure, but requires authenticated access)

Deep Dive & Mechanics

The vulnerability lies in the authorization logic for datasource listing. In Appsmith, datasources are workspace-level resources that contain connection details to external databases or APIs. The intended access control restricts "App Viewer" users from viewing development information, including datasources. However, due to a missing or insufficient permission check, viewers can retrieve a list of datasources in the workspace.

The attack flow:

1. An attacker is invited to a workspace as an "App Viewer".
2. The attacker logs in to the Appsmith instance.
3. The attacker sends a request to the datasource listing endpoint (e.g., /api/v1/datasources).
4. The server returns a list of datasources without verifying that the user has the required permissions.
5. The attacker gains knowledge of datasource names, types, and possibly connection status, but not credentials.

This information can be used for further reconnaissance, such as identifying which databases are in use, potentially leading to targeted attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.51): The datasource listing endpoint likely lacked a permission check for the viewer role. For example, in a controller or service:

// Vulnerable: No role check
app.get('/api/v1/datasources', (req, res) => {
  const workspaceId = req.query.workspaceId;
  const datasources = datasourceService.getDatasources(workspaceId);
  res.json(datasources);
});

Patched Code (1.51): The fix adds a permission check to ensure only users with appropriate roles (e.g., developer, admin) can list datasources.

// Patched: Role check added
app.get('/api/v1/datasources', (req, res) => {
  const workspaceId = req.query.workspaceId;
  const user = req.user;
  if (!user.hasPermission(workspaceId, 'view_datasources')) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const datasources = datasourceService.getDatasources(workspaceId);
  res.json(datasources);
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Appsmith instance (version < 1.51)
• A user account with "App Viewer" role in a workspace

Exploitation Steps:

1. Log in to the Appsmith instance as the viewer user.
2. Identify the workspace ID (e.g., from the URL or API).
3. Send a GET request to the datasource listing endpoint:

   curl -X GET "https://appsmith-instance.com/api/v1/datasources?workspaceId=<WORKSPACE_ID>" \
     -H "Authorization: Bearer <VIEWER_TOKEN>"
   

4. The response will contain a list of datasources, including their names and types.

Example Output:

[
  {
    "id": "ds1",
    "name": "Production DB",
    "type": "PostgreSQL",
    "workspaceId": "ws123"
  },
  {
    "id": "ds2",
    "name": "Staging API",
    "type": "REST API",
    "workspaceId": "ws123"
  }
]

Blue Team

Detection:

• Monitor API logs for unauthorized access to /api/v1/datasources by users with viewer role.
• Alert on multiple datasource listing requests from the same user within a short time frame.

Hunting:

• Search for logs where the user role is "viewer" and the endpoint is /api/v1/datasources.
• Correlate with workspace membership changes.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/v1/datasources with a viewer user token.
• Logs: Access logs showing viewer role users accessing datasource listing endpoints.
• User Behavior: Viewer users making API calls beyond their intended scope.

Detection Engineering

YARA Rule

rule Detect_Appsmith_Viewer_DataSrc_Enum {
  meta:
    description = "Detects Appsmith viewer users enumerating datasources"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2024-55604"
  strings:
    $endpoint = "/api/v1/datasources"
    $role_viewer = "viewer"
  condition:
    $endpoint and $role_viewer
}

Sigma Rule

title: Appsmith Viewer Datasource Enumeration
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects when a user with viewer role accesses datasource listing endpoint
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: appsmith
detection:
  selection:
    http.url: "/api/v1/datasources"
    user.role: "viewer"
  condition: selection
falsepositives:
  - Legitimate viewer access if misconfigured
level: medium

Suricata Rule

alert http any any -> any any (
  msg:"CVE-2024-55604 - Appsmith Viewer Datasource Enumeration";
  flow:to_server;
  content:"/api/v1/datasources"; http_uri;
  content:"viewer"; http_client_body;
  sid:1000001;
  rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade Appsmith to version 1.51 or later.
2. Workaround: No known workarounds. Restrict viewer invitations to trusted users only.
3. Long-term: Implement role-based access control (RBAC) reviews and audit logs for all API endpoints.
4. Monitoring: Enable logging for all datasource-related API calls and alert on unauthorized access attempts.

Valters IT