Missing Authentication in LangChat Exposes Sensitive Data

Executive Summary

LangChat has a missing authentication vulnerability where unauthenticated remote attackers can access REST controllers due to no Sa-Token interceptor being registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthenticated access to /api/v1/auth/users endpoint. Use curl to test if the endpoint returns sensitive data without authentication: curl -v http://<target>/api/v1/auth/users. Monitor for unexpected super-admin account creation or modifications to user roles.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain full control over the system. They can read sensitive data like passwords and API keys, create admin accounts, and delete or modify data, leading to data breaches, unauthorized access, and potential system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive data, lack of authentication, and potential data breaches. It can result in non-compliance, legal penalties, and reputational damage for organizations handling protected data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /api/v1/auth/users endpoint. Update LangChat to a patched version where Sa-Token interceptor is properly registered. Rotate all exposed API keys and passwords. Implement network-level controls to block unauthorized access to REST controllers.

Useful 0 Not Useful 0