Description
AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
beenuar AiSOC
Default version status: unaffected
9.0.0 to < 12.0.0affected
References
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-g4h7-p63q-r8r4 ↗
- https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2 ↗
- https://github.com/beenuar/AiSOC/releases/tag/v12.0.0 ↗
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/security/authz.py#L104-L121 ↗
- https://www.vulncheck.com/advisories/aisoc-9.0.0-before-12.0.0-missing-authentication-on-actions-service-response-action-api ↗