CVE-2024-8057

Executive Summary

CVE-2024-8057 is a privilege escalation vulnerability in danswer-ai/danswer version 0.4.1. The flaw allows a basic (non-admin) user to create credentials and link them to an existing connector, a function that should be restricted to admin users. This unauthorized action can lead to excessive resource consumption, potentially causing a Denial of Service (DoS) and other stability issues. The vulnerability has a CVSS score of 4.3 (Medium) and is currently unpatched. No public exploit code or proof-of-concept is available, but the risk is elevated due to the lack of a patch.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (basic user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized credential creation)
• Availability Impact: Low (potential DoS via resource exhaustion)

The threat level is elevated due to the lack of a patch and the potential for resource exhaustion attacks. While the CVSS score is medium, the impact on system stability could be significant in production environments.

Deep Dive & Mechanics

The vulnerability resides in the credential management and connector linking functionality of danswer-ai/danswer. In version 0.4.1, the application fails to enforce proper authorization checks when a user attempts to create credentials and associate them with an existing connector. The intended design restricts this action to admin users, but the code does not validate the user's role before processing the request.

Root Cause: Missing authorization check in the API endpoint responsible for credential creation and connector linking. The endpoint likely uses a function like create_credentials() or link_credentials_to_connector() that does not verify the user's admin status.

Attack Flow:

1. An attacker registers a basic user account (if registration is open) or compromises an existing basic user account.
2. The attacker sends a crafted API request to create credentials and link them to an existing connector.
3. The system processes the request without checking if the user has admin privileges.
4. The attacker can then use these credentials to perform actions that consume excessive resources (e.g., triggering multiple connector syncs, creating large numbers of credentials), leading to a DoS condition.

Impact: Unauthorized credential creation can lead to resource exhaustion, as the system may attempt to process or store excessive credentials. This can degrade performance or crash the service.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the credential creation endpoint. A patched version would include an authorization check.

Vulnerable Code (Conceptual):

@app.route('/api/credentials', methods=['POST'])
def create_credentials():
    data = request.json
    # Missing authorization check
    credentials = Credentials.create(data)
    return jsonify(credentials.to_dict()), 201

Patched Code (Conceptual):

@app.route('/api/credentials', methods=['POST'])
def create_credentials():
    if not current_user.is_admin:
        return jsonify({'error': 'Unauthorized'}), 403
    data = request.json
    credentials = Credentials.create(data)
    return jsonify(credentials.to_dict()), 201

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of danswer-ai/danswer version 0.4.1.
• A basic user account (or ability to register one).

Exploitation Steps:

1. Register a basic user account via the signup endpoint.
2. Obtain an authentication token for the basic user.
3. Send a POST request to the credential creation endpoint with the token and payload to create credentials and link them to an existing connector.

Example Request (using curl):

curl -X POST https://target.com/api/credentials \
  -H "Authorization: Bearer <basic_user_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "connector_id": 1,
    "credential_type": "api_key",
    "value": "attacker_controlled_key"
  }'

Expected Outcome: The system accepts the request and creates the credential, linking it to the specified connector. The attacker can then trigger resource-intensive operations using this credential.

Blue Team

Detection:

• Monitor API logs for credential creation requests from non-admin users.
• Alert on any POST requests to /api/credentials where the user role is not admin.
• Track the number of credentials created per user; a sudden spike may indicate exploitation.

Mitigation:

• Implement strict role-based access control (RBAC) on all credential-related endpoints.
• Disable self-registration if not required, or enforce email verification and manual approval.
• Apply rate limiting to credential creation endpoints to prevent resource exhaustion.

Indicators of Compromise (IOCs)

• Network: Unusual POST requests to /api/credentials from non-admin users.
• Logs: Entries showing credential creation by users with role basic or user.
• System: High CPU or memory usage due to excessive credential processing.
• File System: Unexpected credential files or database entries linked to connectors.

Detection Engineering

YARA Rule

rule Detect_Danswer_Credential_Abuse {
    meta:
        description = "Detects unauthorized credential creation in danswer-ai/danswer logs"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8057"
    strings:
        $credential_creation = "POST /api/credentials" ascii wide nocase
        $user_role = "role" ascii wide nocase
        $basic_user = "basic" ascii wide nocase
    condition:
        $credential_creation and $user_role and $basic_user
}

Sigma Rule

title: Unauthorized Credential Creation in danswer-ai/danswer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /api/credentials from non-admin users
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8057
author: Valters IT
date: 2024-10-27
logsource:
    category: web
    product: danswer
detection:
    selection:
        http.method: POST
        http.url: "/api/credentials"
        http.user_role: "basic"
    condition: selection
falsepositives:
    - Legitimate admin actions (if role misconfigured)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8057 - Unauthorized Credential Creation in danswer-ai/danswer"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/credentials"; http.user_agent; content:"basic"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable self-registration if not required, or enforce manual approval for new accounts.
2. Implement RBAC on all credential-related endpoints to restrict creation to admin users.
3. Apply rate limiting to credential creation to prevent resource exhaustion.

Long-Term Fix:

• Upgrade to a patched version once available (monitor the danswer-ai GitHub repository for updates).
• Conduct a code review of all API endpoints to ensure proper authorization checks.

Workaround:

• Use a Web Application Firewall (WAF) to block POST requests to /api/credentials from non-admin IP ranges.

Valters IT