CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

Critical 9.1 Published 8 Feb 2024 Updated 1 Aug 2024

Any authenticated user can remove other users, including admins, due to missing privilege checks in the user removal API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-25106?

CVE-2024-25106 is a critical missing authorization vulnerability in openobserve, published on 8 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any authenticated user within an organization to remove any other user from that same organization, irrespective of their respective roles. This includes the ability to remove users with "Admin" and "Root" roles. By enabling any organizational member to unilaterally alter the user base, it opens the door to unauthorized access and can cause considerable disruptions in operations. The core of the vulnerability lies in the `remove_user_from_org` function in the user management system. This function is designed to allow organizational users to remove members from their organization. The function does not check if the user initiating the request has the appropriate administrative privileges to remove a user. Any user who is part of the organization, irrespective of their role, can remove any other user, including those with higher privileges. This vulnerability is categorized as an Authorization issue leading to Unauthorized User Removal. The impact is severe, as it compromises the integrity of user management within organizations. By exploiting this vulnerability, any user within an organization, without the need for administrative privileges, can remove critical users, including "Admins" and "Root" users. This could result in unauthorized system access, administrative lockout, or operational disruptions. Given that user accounts are typically created by "Admins" or "Root" users, this vulnerability can be exploited by any user who has been granted access to an organization, thereby posing a critical risk to the security and operational stability of the application. This issue has been addressed in release version 0.8.0. Users are advised to upgrade.

Weakness: CWE-287, CWE-284, CWE-272, CWE-285, CWE-269

Which versions are affected by CVE-2024-25106?

It affects 1 product.

Products include Openobserve Openobserve.

How do I fix CVE-2024-25106?

No fix has been published for CVE-2024-25106 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-25106 being exploited?

There is no known exploitation of CVE-2024-25106 in the wild and no public exploit code.

Sources

Also known as GHSA-3m5f-9m66-xgp7.