Description
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Stonewuu ai-fusion-video
Default version status: unaffected
0 to ≤ 1.2.0affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ai-fusion-video-broken-access-control-and-upload-path-traversal ↗
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/ai/ApiConfigController.java#L81-L102 ↗
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/system/SystemConfigController.java#L26-L36 ↗
- https://www.vulncheck.com/advisories/ai-fusion-video-through-1.2.0-missing-authorization-in-configuration-read-endpoints-exposes-stored-credentials ↗