Description
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for another department's skill to obtain version numbers, hashes, storage paths and changelogs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nduckmink arkon
Default version status: unaffected
0 to ≤ 0.9.2affected
pkg:github/nduckmink/arkonReferences
- https://hackmd.io/@hieuPenguinnn/arkon-wiki-graph-cross-department-idor ↗
- https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py#L427-L434 ↗
- https://github.com/nduckmink/arkon/blob/v0.9.2/app/routers/skills.py#L408-L425 ↗
- https://www.vulncheck.com/advisories/arkon-through-0.9.2-missing-authorization-via-skills-versions-api ↗