Description
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
looplj AxonHub
Default version status: unaffected
0 to ≤ 1.0.0-beta11affected
pkg:golang/github.com/looplj/axonhubReferences
- https://github.com/looplj/axonhub/commit/e5c904efbdabd80d74827dfae478330339c5a514 ↗
- https://github.com/looplj/axonhub/pull/2741 ↗
- https://github.com/looplj/axonhub/issues/2724 ↗
- https://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key.go#L340 ↗
- https://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key.go#L448 ↗
- https://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation ↗
- https://github.com/looplj/axonhub ↗
- https://www.vulncheck.com/advisories/axonhub-through-1.0.0-beta11-privilege-escalation-via-service-account-api-key-scopes ↗