Description
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Stonewuu ai-fusion-video
Default version status: unaffected
0 to ≤ 1.2.0affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ai-fusion-video-broken-access-control-and-upload-path-traversal ↗
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/generation/ImageGenerationController.java#L50-L54 ↗
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/generation/VideoGenerationController.java#L49-L53 ↗
- https://www.vulncheck.com/advisories/ai-fusion-video-through-1.2.0-insecure-direct-object-reference-in-generation-task-item-endpoints ↗