Description
53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
53AI 53AIHub
Default version status: unaffected
0 to ≤ 0.5.3affected
pkg:github/53AI/53AIHubReferences
- https://hackmd.io/@hieuPenguinnn/53aihub-unauth-cross-tenant-enterprise-update ↗
- https://github.com/53AI/53AIHub/blob/v0.5.3/api/router/api.go#L54-L66 ↗
- https://github.com/53AI/53AIHub/blob/v0.5.3/api/controller/enterprise.go#L122-L160 ↗
- https://www.vulncheck.com/advisories/53aihub-through-0.5.3-missing-authentication-via-put-api-enterprises-id ↗