Description
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign source IDs to disclose derived wiki titles and summaries and alter ingestion state.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nduckmink arkon
Default version status: unaffected
0 to ≤ 0.9.2affected
pkg:github/nduckmink/arkonReferences
- https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor ↗
- https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/sources.py#L644-L673 ↗
- https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/sources.py#L295-L312 ↗
- https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/sources.py#L257-L275 ↗
- https://www.vulncheck.com/advisories/arkon-through-0.9.2-broken-access-control-via-sources-by-id-routes ↗