Description
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
wannabespace tamery
Default version status: unaffected
0.32.0 to < 0.99.0affected
References
- https://github.com/wannabespace/tamery/issues/601 ↗
- https://github.com/wannabespace/tamery/commit/400a9001a661e5ab2f87c51de25da1c4afa7ceed ↗
- https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/connections-resources/create.ts#L14-L32 ↗
- https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write ↗
- https://github.com/wannabespace/tamery ↗
- https://www.vulncheck.com/advisories/tamery-conar-0.32.0-before-0.99.0-broken-authorization-via-connectionsresources-create ↗