Compliance Impact

This vulnerability allows an unauthenticated attacker to bypass password authentication and gain access as any user, including the root administrator. Such unauthorized access can lead to exposure, modification, or deletion of sensitive data.

Consequently, this poses a significant risk to compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive personal and health information.

Failure to prevent unauthorized access could result in violations of these regulations, potentially leading to legal penalties, data breaches, and loss of trust.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in FastGPT versions prior to 4.14.9.5. The password-based login endpoint uses TypeScript type assertion without runtime validation, which allows an unauthenticated attacker to pass a MongoDB query operator object (such as {"$ne": ""}) as the password field. This leads to a NoSQL injection that bypasses the password check, enabling the attacker to log in as any user, including the root administrator.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an unauthenticated attacker to bypass authentication controls and gain access to any user account, including the root administrator. This can lead to full system compromise, unauthorized data access, data modification, and disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade FastGPT to version 4.14.9.5 or later, where the issue has been fixed.

Useful 0 Not Useful 0