Authorization Bypass in OpenCSG CSGHub via File Path Injection

Executive Summary

This vulnerability is an authorization bypass in OpenCSG CSGHub v2.6.0-ce that allows unauthenticated attackers to read private repository files. The issue occurs in the file resolve route, which lacks authentication middleware. Attackers can inject a percent-encoded 'current_user' parameter into the file path, overriding the intended user identity. The portal then forwards the request with its administrative API key, trusting the injected user parameter and granting access to private files in model, code, or space repositories.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized requests to the resolve route pattern '/:repo_type/:namespace/:name/resolve/:branch/*path' without a user_token cookie. Check server logs for requests using the global administrative API key with injected 'current_user' parameters. Test by sending crafted requests with percent-encoded paths containing '?current_user=owner_name' to see if private files are returned.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive files in private repositories without authentication. This includes source code, configurations, or accidentally committed secrets. Attackers could steal proprietary information, intellectual property, or sensitive data stored in private model, code, or space repositories. The impact is limited to repositories other than datasets, as those require login.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection. GDPR requires protecting personal data, and HIPAA requires safeguarding protected health information. Unauthorized access to private repositories may result in data breaches, leading to legal penalties, fines, or reputational damage for organizations failing to secure sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of CSGHub beyond v2.6.0-ce. Remove the fallback to the administrative API key in the resolve route. Add authentication guards to the resolve route to enforce user_token validation. Disable unauthenticated access to the resolve endpoint and implement proper path encoding to prevent parameter injection.

Useful 0 Not Useful 0