VoltAgent Memory REST API IDOR: Authenticated Users Can Access Other Users Conversations via conversationId

Vulnerability Overview Title: [BUG] Memory REST API permits cross-user conversation access by conversationId #1315 Description: The memory REST API handler in VoltAgent, when processing object backups, uses the and optional values provided by the caller. However, it does not receive or enforce the authentication principal from the server's authentication middleware. This allows authenticated callers to read, list, clone, search, or delete other users' conversations, compromising object-level authorization checks on the memory API surface. Impact Scope Affected packages: - up to 2.1.17 - up to 2.0.13 - up to 2.0.8 - up to the current version Specific impacts: - Authenticated callers can access other users' conversations, messages, and working memory. - Calls can delete other users' conversations. Remediation 1. Verify Authorization: - Each conversation/message/working memory operation must be bound to the authentication principal and the expected resource/agent scope. - by should validate that or an equivalent policy decision. - Message lists should not fall back to the of a different authenticated caller. - / operations must enforce the same ownership resource policy before mutating state. - The in should not be trusted as an authorization source. 2. Pass Authentication Context: - Pass the authenticated user context from the server middleware to the memory route handlers, including all methods (e.g., / ). 3. Enforce Object-Level Authorization: - Enforce object-level authorization before returning or mutating conversations, messages, working memory, vector search results, or cloned conversations. 4. Validate Query Body Values: - Use query body values (such as , , ) as selectors only after they have been validated against the authentication principal and authorization policies. 5. Add Regression Tests: - Add regression tests for attempts to read, update, clone, delete, and search across users. POC Code Additional Information Report Date: May 27, 2024 Status: Open Labels: Bug Participants: VoltAgent Team Summary This vulnerability allows authenticated callers to access other users' conversations, messages, and working memory via , posing a serious security risk. The remediation strategy includes verifying authorization, passing the authentication context, enforcing object-level authorization, validating query body values, and adding regression tests.

Goal Reached Thanks to every supporter — we hit 100%!

VoltAgent Memory REST API IDOR: Authenticated Users Can Access Other Users Conversations via conversationId

More from this source