Description
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
iflytek skillhub
Default version status: unaffected
0 to ≤ 0.2.22affected
pkg:github/iflytek/skillhubReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skillhub-cli-skill-delete-missing-ownership-check ↗
- https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/SkillDeleteAppService.java#L95-L127 ↗
- https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliSkillController.java#L88-L96 ↗
- https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/cli/CliSkillAppService.java#L149-L161 ↗
- https://github.com/iflytek/skillhub ↗
- https://www.vulncheck.com/advisories/skillhub-through-0.2.22-missing-authorization-in-cli-skill-delete-endpoint ↗