CVE-2024-55965

Executive Summary

CVE-2024-55965 is an information disclosure vulnerability in Appsmith, an open-source low-code platform for building internal tools. The flaw allows users invited with the "App Viewer" role to incorrectly access development information of a workspace, specifically a list of datasources within that workspace. While the vulnerability does not expose sensitive data such as database passwords or API keys, it does leak the names and types of datasources, which can aid an attacker in reconnaissance and subsequent targeted attacks. The vulnerability is present in Appsmith versions before 1.51. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Appsmith is distributed as a Docker image and via npm packages. The vulnerability affects the core application logic, not a specific package dependency. Users should ensure they are running Appsmith version 1.51 or later, which contains the fix. Verify the version by checking the Appsmith admin panel or the Docker image tag.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a valid "App Viewer" account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Only non-sensitive datasource names are exposed.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS v3.1 Score: 4.3 (Medium)

Threat Level: Medium. The vulnerability requires an authenticated "App Viewer" account, limiting the attack surface. However, it can aid in reconnaissance for more severe attacks.

Deep Dive & Mechanics

The vulnerability lies in the authorization logic of Appsmith's workspace management. When a user is invited as an "App Viewer," they should only have access to view and interact with published applications. However, due to a flaw in the permission checks, the user is incorrectly granted access to the workspace's development information, including a list of datasources.

The datasource list includes names and types (e.g., "PostgreSQL," "MongoDB," "REST API"), but not credentials or connection strings. This information can be used by an attacker to:

• Identify the technology stack in use.
• Plan targeted attacks against specific database types.
• Map the internal network topology if datasource names reveal hostnames or IPs.

The vulnerability is triggered when an "App Viewer" makes a request to the workspace's datasource listing endpoint. The server fails to verify that the user's role does not permit access to this endpoint, returning the list instead of an authorization error.

Vulnerable vs. Patched Code

The fix involves adding a role check in the datasource listing endpoint to ensure only users with "Developer" or "Administrator" roles can access it.

Vulnerable Code (before 1.51):

// In the datasource listing endpoint handler
app.get('/api/v1/datasources', (req, res) => {
  const workspaceId = req.query.workspaceId;
  // Missing role check
  const datasources = getDatasourcesForWorkspace(workspaceId);
  res.json(datasources);
});

Patched Code (version 1.51):

// In the datasource listing endpoint handler
app.get('/api/v1/datasources', (req, res) => {
  const workspaceId = req.query.workspaceId;
  const userRole = getUserRoleInWorkspace(req.user.id, workspaceId);
  if (userRole !== 'Developer' && userRole !== 'Administrator') {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const datasources = getDatasourcesForWorkspace(workspaceId);
  res.json(datasources);
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid Appsmith instance running version < 1.51.
• An "App Viewer" account in a workspace.

Steps:

1. Log in to Appsmith as an "App Viewer" user.
2. Intercept the request to the datasource listing endpoint using a proxy like Burp Suite.
3. Send a GET request to /api/v1/datasources?workspaceId=<workspace_id>.
4. Observe the response containing a list of datasources with names and types.

Example Request:

GET /api/v1/datasources?workspaceId=abc123 HTTP/1.1
Host: appsmith.example.com
Cookie: SESSION=viewer_session_cookie

Example Response:

[
  {
    "id": "ds1",
    "name": "Production PostgreSQL",
    "type": "PostgreSQL"
  },
  {
    "id": "ds2",
    "name": "Staging MongoDB",
    "type": "MongoDB"
  }
]

Blue Team

Detection:

• Monitor for unauthorized access to the /api/v1/datasources endpoint by users with the "App Viewer" role.
• Look for repeated requests to this endpoint from a single user, indicating reconnaissance.

Mitigation:

• Upgrade to Appsmith version 1.51 or later.
• Implement additional logging for role-based access control violations.
• Use a Web Application Firewall (WAF) to block suspicious requests.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/v1/datasources with a valid session cookie for an "App Viewer" user.
• Logs: Server logs showing 200 responses to the datasource endpoint from users with the "App Viewer" role.
• File: No file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_55965_Appsmith_InfoDisclosure {
    meta:
        description = "Detects Appsmith datasource listing requests from App Viewer users"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55965"
    strings:
        $endpoint = "/api/v1/datasources"
        $role = "App Viewer"
    condition:
        $endpoint and $role
}

Sigma Rule

title: Appsmith Datasource Listing by App Viewer
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects when an App Viewer user accesses the datasource listing endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55965
logsource:
    category: application
    product: appsmith
detection:
    selection:
        http.request.method: GET
        http.request.uri: "/api/v1/datasources"
        user.role: "App Viewer"
    condition: selection
falsepositives:
    - Legitimate debugging by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55965 Appsmith Datasource Listing by App Viewer"; flow:to_server; content:"GET"; http_method; content:"/api/v1/datasources"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Appsmith to version 1.51 or later.
• Review user roles and permissions to ensure "App Viewer" accounts are not over-privileged.

Long-term:

• Implement regular security audits of role-based access controls.
• Use a vulnerability scanner to detect similar issues in the future.
• Monitor logs for unauthorized access attempts.

Workaround:

• If upgrading is not immediately possible, restrict network access to the Appsmith instance to trusted users only.

Report generated by Valters IT DevSecOps & CTI Expert System