GHSA-hq4h-w933-jm6c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hq4h-w933-jm6c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-hq4h-w933-jm6c/GHSA-hq4h-w933-jm6c.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-hq4h-w933-jm6c
- Aliases
- Related
- Published
- 2024-12-30T16:12:40Z
- Modified
- 2024-12-30T19:03:28.411493Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- khoj has an IDOR in subscription management allows unauthorized subscription modifications
- Details
-
Summary
An Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request.
Details
The vulnerability exists in the subscription endpoint at
/api/subscription. The endpoint uses an email parameter as a direct reference to user subscriptions without verifying object ownership. While authentication is required, there is no authorization check to verify if the authenticated user owns the referenced subscription.Vulnerable code in
/api/subscription:@subscription_router.patch("") @requires(["authenticated"]) async def update_subscription(request: Request, email: str, operation: str): # IDOR: email parameter directly references user subscriptions without ownership verification customers = stripe.Customer.list(email=email).auto_paging_iter() customer = next(customers, None) if operation == "cancel": # Any authenticated user can modify any subscription referenced by email customer_id = customer.id for subscription in stripe.Subscription.list(customer=customer_id): stripe.Subscription.modify(subscription.id, cancel_at_period_end=True)PoC
Create a customer account in stripe:
- Customer A:
adventure8812@zeropath.com(attacker)
- Customer A:
Log in as any user.
Send this request:
PATCH /api/subscription?email=adventure8812@zeropath.com&operation=cancel HTTP/1.1The subscription for Customer A is successfully set to cancel.
Impact
High: Revenue loss via mass cancellation of subscriptions. Loss of customer trust by re-enabling subscriptions they had set to cancel.
Resolution
This was fixed in the following commit which limited subscription update operations to the authenticated user: https://github.com/khoj-ai/khoj/commit/47d3c8c23597900af708bdc60aced3ae5d2064c1. Support for arbitrarily presenting an email for update has been deprecated.
- Database specific
{ "nvd_published_at": "2024-12-30T17:15:09Z", "cwe_ids": [ "CWE-639" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-12-30T16:12:40Z" }- References
Affected packages
PyPI / khoj
Package
- Name
- khoj
- View open source insights on deps.dev
- Purl
- pkg:pypi/khoj
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.29.0