Description
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
iflytek astron-rpa
Default version status: unaffected
0 to ≤ 1.1.6affected
References
- https://github.com/iflytek/astron-rpa/issues/884 ↗
- https://github.com/iflytek/astron-rpa ↗
- https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/dao/SharedVarDao.xml#L52-L63 ↗
- https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/robot-service/src/main/java/com/iflytek/rpa/robot/service/impl/SharedVarServiceImpl.java#L197-L255 ↗
- https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-cross-tenant-shared-variable-disclosure-via-get-batch-shared-var ↗