Authorization Bypass in Trigger.dev Allows S2 Stream Credential Theft

Executive Summary

Trigger.dev before version 4.6.2 has an authorization flaw where public-token holders with session write access can obtain environment-wide S2 stream credentials during session input initialization. These credentials allow attackers to modify or delete any realtime stream in the same environment, not just the authorized input stream. The issue stems from overly broad credentials being issued instead of ones scoped to specific streams.

Useful 0 Not Useful 0

Detection Guidance

Check if your trigger.dev instance is running a version before 4.6.2. Use commands like 'npm list trigger.dev' or 'docker inspect <container_name> | grep trigger.dev' to verify the installed version. Inspect network traffic for unauthorized API calls to storage endpoints using tools like Wireshark or tcpdump.

Useful 0 Not Useful 0

Impact Analysis

Attackers can forge output in their own session or modify/trim other streams if they know the stream name, potentially permanently deleting records. They can also append records or create new streams. The vulnerability does not grant read access but allows unauthorized data manipulation and destruction within the environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data modification or deletion, which may violate GDPR's integrity and availability principles (Article 5) and HIPAA's integrity and availability requirements (45 CFR §164.312). Unauthorized access to session streams could expose sensitive data, potentially breaching GDPR's confidentiality (Article 5) and HIPAA's safeguard requirements (45 CFR §164.312).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade trigger.dev to version 4.6.2 or later immediately. Revoke all existing public tokens and session credentials, as they may have been compromised. Restrict session stream initialization to trusted callers only as a temporary measure.

Useful 0 Not Useful 0