CVE-2024-9617

MEDIUMNuclei

IDOR in danswer-ai/danswer

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-9617 has a selected CVSS score of 6.5 (medium); EIP currently links 1 Nuclei template.

Description

An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 20, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

danswer-ai/danswer

Browse danswer-ai / danswer-ai/danswer
CVE ListThrough latestaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMDanswer - Insecure Direct Object ReferenceCVSS 6.5

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.

Impact

Authenticated attackers can access and view files belonging to other users without proper authorization checks through insecure direct object references, leading to unauthorized disclosure of sensitive chat files and data.

Remediation

Update Danswer to a version that implements proper authorization checks to verify file ownership before allowing access through the GET /api/chat/file/{file_id} and GET /api/chat/get-chat-session endpoints.

WeaknessesCWE-284
Authorss4e-io
Template tagscvecve2024dansweridorvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
FOFA: icon_hash="484766002"
https://huntr.com/bounties/8f683ff6-3a99-41c6-b763-a8f7b73bd146 https://github.com/danswer-ai/danswer

Source: ProjectDiscovery

References

2