Insecure Direct Object Reference in langchain4j-aideepin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in langchain4j-aideepin through version 3.32.0. It allows authenticated users to access other users' message references without proper authorization checks. By supplying another user's message UUID to specific endpoints like knowledge-embedding-ref, memory-embedding-ref, or graph-ref, attackers can retrieve sensitive data such as knowledge-base chunks, long-term memory text, and knowledge-graph information.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to endpoints like /character/message/knowledge-embedding-ref/{uuid}, /character/message/memory-embedding-ref/{msgUuid}, or /character/message/graph-ref/{uuid}. Check application logs for repeated requests with different UUIDs from the same user. Inspect SQL queries for missing user_id conditions in joins involving adi_character_message_ref_memory_embedding or similar tables.

Useful 0 Not Useful 0

Impact Analysis

If you use langchain4j-aideepin, an attacker with access to your system could exploit this flaw to access private data belonging to other users. This includes sensitive information stored in knowledge bases, long-term memory, or knowledge graphs. The impact depends on the data stored in the system, but could lead to unauthorized data exposure or privacy breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA. Unauthorized access to personal or sensitive data violates principles of data minimization, purpose limitation, and security. Organizations using affected versions may face legal penalties, reputational damage, and loss of customer trust.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch from commit 483499b to enforce owner checks in SQL queries and services. Ensure all endpoints include user_id conditions in their queries. Update to the latest version of langchain4j-aideepin if available. Review and restrict access to the vulnerable endpoints until patched.

Useful 0 Not Useful 0