CVE-2024-9617 PoC — Danswer 访问控制错误漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9617.yaml

Associated Vulnerability

Title:Danswer 访问控制错误漏洞 (CVE-2024-9617)
Description:Danswer是Danswer AI开源的一个连接到公司文档、应用程序和人员的人工智能助手。 Danswer v0.3.94版本存在访问控制错误漏洞，该漏洞源于应用未验证文件创建者，可能导致攻击者查看任意文件。

Description

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.

File Snapshot


 id: CVE-2024-9617

info:
  name: Danswer - Insecure Direct Object Reference
  author: s4e-io
  sever

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!