Fix cross-workspace OAuth credential theft and arbitrary S3 write vulnerability

Vulnerability Overview Title: Fix credential access control and remove vulnerable S3 upload endpoint #2459 Status: Merged Author: baptisteArno Date: Apr 15 Impact Scope Cross-workspace OAuth Credential Theft: Attackers can steal cross-workspace OAuth credentials via the function. Google Sheets OAuth Token Retrieval: Attackers can obtain Google Sheets OAuth tokens via the function. OpenAI API Key Disclosure: Attackers can retrieve OpenAI API keys via the function. Arbitrary S3 Object Write: Attackers can write arbitrary S3 objects via an unauthenticated upload endpoint. Remediation Bind Credential Updates to Workspace Ownership: In the function, bind credential updates to workspace ownership to prevent cross-workspace OAuth credential theft. Require Write Access: In the function, require write access to prevent the retrieval of Google Sheets OAuth tokens. Require Write Access: In the function, require write access to prevent the retrieval of OpenAI API keys. Remove Unauthenticated Upload Endpoint: Remove the unauthenticated upload endpoint that allows arbitrary S3 object writes. POC Code No specific POC or exploit code is included in this page. Additional Information Reviewer: github-actions[bot] Assignee: Unassigned Labels: None Projects: None Milestone: None Development Status: This pull request may close these issues. Participants: 1 person Summary This vulnerability involves multiple security issues, including cross-workspace OAuth credential theft, Google Sheets OAuth token retrieval, OpenAI API key disclosure, and arbitrary S3 object writes. The remediation measures include binding credential updates to workspace ownership, requiring write access, and removing the unauthenticated upload endpoint.

Goal Reached Thanks to every supporter — we hit 100%!

Fix cross-workspace OAuth credential theft and arbitrary S3 write vulnerability

More from this source