LibreChat IDOR in Message Deletion (CVE-2024-41703): Incomplete Fix Leaves deleteMessages() Without User Filter

Vulnerability Overview IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves Without User Filter This vulnerability concerns the message deletion functionality in LibreChat. The endpoint allows any authenticated user to delete messages belonging to other users. The middleware only verifies that the belongs to the requesting user, but the handler uses only the as the MongoDB filter, without adding user constraints. An attacker can provide their own valid (which passes validation) and the victim's (as the target for deletion), leading to permanent and unrecoverable deletion of messages. Scope of Impact Affected Versions: <= 0.8.3 Fixed Versions: v0.8.4-rc1 Severity: 5.3 / 10 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None Remediation The fix involves adding a user filter to the function to ensure that only the owner of the message can delete it. The specific fix is as follows: POC Code Below is the Proof of Concept (PoC) code for exploiting this vulnerability: Step 1: Register two users and log in Step 2: Victim creates a conversation and a message Step 3: Attacker creates their own conversation (required to pass ) Step 4: Exploitation - Attacker uses their own to delete the victim's message Step 5: Verification - Victim's message has disappeared Impact This vulnerability allows any authenticated user to permanently delete any message in the system. Messages in LibreChat are not soft-deleted; permanently removes them from MongoDB. Real-world attack scenarios include: 1. Evidence Tampering - Deleting specific messages to alter the conversation history. 2. Service Disruption - Mass deleting messages across conversations to break AI threads. 3. Data Loss - Deleted messages cannot be recovered. The attacker needs to know the victim's (UUID). While UUIDs are not directly guessable, they can be discovered through shared/forked conversations, browser DevTools during collaboration, or other IDOR vulnerabilities that expose message lists.

Goal Reached Thanks to every supporter — we hit 100%!

LibreChat IDOR in Message Deletion (CVE-2024-41703): Incomplete Fix Leaves deleteMessages() Without User Filter

More from this source