Flow-Like Studio Azure Storage SAS Permission Bypass (CVE-2024-50173) Analysis

Vulnerability Overview Title: Azure invoke presign grants app content write SAS to ExecuteEvents-only users Description: For Users: - Flow-Like Studio and hosted Flow-Like Web App are not affected, as these deployments use AWS backend storage. - Self-hosted deployments are affected only when they use Azure Blob Storage as the storage backend. - In affected deployments, the issue applies only to authenticated application members with workflow execution permissions but who should not have application content write permissions. - Update is recommended for affected self-hosted Azure deployments: update to the latest dev branch. Summary: - grants Azure Blob Storage SAS credentials allowing write and delete access to application content, even if the member lacks and permissions. - The route treats file permissions as optional operations gated by . When the caller lacks file permissions, it selects . In the Azure credentials provider, still generates a for , along with user content and logs SAS credentials. The returned shared credentials allow low-privileged callers to directly write to or delete blobs under the application content prefix. Impact: - Authenticated application members with workflow execution permissions can bypass the application content permission model in Azure backend deployments. This allows uploading application content, corrupting workflow inputs or outputs stored under the application content prefix, and bypassing the adjacent gate enforced during normal data upload and data path routing. - This is provider-specific. The AWS policy grants write access to each user and temporary prefix plus logs, but not the application content prefix. The Azure implementation grants application content for the same mode. Scope Affected Versions: - From dev branch to - Patched versions: 1.0.4 or the latest dev branch CVSS v3 Base Metrics: - Severity: High (7.2 / 10) - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: Low - Integrity: High - Availability: Low - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2024-50173 Remediation Recommended Fixes: - Remove for in , or make it read-only if read access is required at runtime. - Align with the intent of AWS file-less execution by restricting this mode to each user or temporary prefix plus logs. - Alternatively, require permission before returning application content SAS in . Add Regression Tests: - Add regression tests covering these role combinations for Azure, AWS, GCP, and R2 credentials scopes: - only: no application content write/delete credentials - + : read-only application content credentials - + : write application content credentials POC Code Reproduction Steps 1. Configure a Flow-Like deployment using the Azure storage provider. 2. Create an application role for a non-owner member containing but excluding and . 3. Authenticate as that member. 4. Call: 5. Observe that the response contains Azure shared credentials with set to and a non-empty . 6. Decode the query string, which contains write and delete permissions for the application content prefix, such as or equivalent permission letters. 7. Use the returned , , , and to upload or delete blobs: 8. As a control, the same user is denied with , as this route requires before generating write credentials. Expected Behavior Callers with only should not receive direct application content write or delete credentials. should not generate a writable SAS for .

Goal Reached Thanks to every supporter — we hit 100%!

Flow-Like Studio Azure Storage SAS Permission Bypass (CVE-2024-50173) Analysis

More from this source