Description
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
beenuar AiSOC
Default version status: unaffected
5.1.0 to < 12.0.0affected
References
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37 ↗
- https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43 ↗
- https://github.com/beenuar/AiSOC/releases/tag/v12.0.0 ↗
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/index.ts#L681-L691 ↗
- https://www.vulncheck.com/advisories/aisoc-5.1.0-before-12.0.0-missing-authentication-on-realtime-service-internal-endpoints ↗