Description
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
LangChat langchat
Default version status: unaffected
0 to ≤ 2a6285a6b8c51d51cdc599771bb667a30bc03f5caffected
pkg:github/LangChat/langchatReferences
- https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposure ↗
- https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-server/src/main/java/cn/langchat/server/config/WebAsyncConfig.java#L17-L33 ↗
- https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/controller/AigcUserController.java#L25-L60 ↗
- https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/service/impl/AuthServiceImpl.java#L51-L58 ↗
- https://www.vulncheck.com/advisories/langchat-through-commit-2a6285a-missing-authentication-on-rest-api-controllers ↗