Authenticated Skill Deletion in iFlytek SkillHub

Executive Summary

This vulnerability is a missing authorization flaw in iFlytek SkillHub through version 0.2.22. It allows any authenticated user to permanently delete other users' skills via a DELETE request to /api/cli/v1/skills/{namespace}/{slug}. The attack bypasses ownership checks, resulting in complete removal of all versions, files, reviews, ratings, and metadata associated with the target skill.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to /api/cli/v1/skills/{namespace}/{slug} from non-admin users. Check logs for unauthorized deletions of skills not owned by the requester. Use network traffic analysis tools like Wireshark or tcpdump to inspect API calls targeting this endpoint.

Useful 0 Not Useful 0

Impact Analysis

If you use a shared SkillHub instance, an attacker with an authenticated account could delete your skills without permission. This leads to loss of your work, data, and reputation. The impact includes unavailability of your skills and potential disruption of services relying on them.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized deletion of user data. It risks violating integrity and availability requirements, potentially resulting in data loss and breaches of confidentiality obligations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of SkillHub beyond 0.2.22. Temporarily restrict access to the CLI delete endpoint by modifying authentication policies to enforce ownership checks. Disable API token minting with skill:delete scope until patched. Monitor for unauthorized deletions in logs.

Useful 0 Not Useful 0