Authenticated User Privilege Escalation in EnergizeLab Station-Middleware

Executive Summary

This vulnerability affects EnergizeLab station-middleware Docker images versions 1.6.5 through 1.8.2. It allows any authenticated low-privilege user to access administrative APIs without proper role checks. This means they can retrieve sensitive AI provider keys and modify system configurations or stored data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your EnergizeLab station-middleware Docker images are running versions between 1.6.5 and 1.8.2. Run 'docker ps' to list containers and inspect their image versions. Verify if administrative APIs are accessible without proper role checks by testing endpoints with low-privilege credentials.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data like AI provider keys. They might alter system configurations, delete or corrupt stored objects, or disrupt operations. The high CVSS score (9.6) indicates severe potential impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade EnergizeLab station-middleware Docker images to version 1.8.3 or later where the issue is fixed. Ensure all administrative APIs enforce proper role-based access control to prevent unauthorized access.

Useful 0 Not Useful 0