Executive Summary

This vulnerability exists in FastGPT versions prior to 4.14.9.5 in the password change endpoint. It is a NoSQL injection flaw that allows an authenticated attacker to bypass the verification of the "old password" by injecting MongoDB query operators.

As a result, an attacker with a low-privileged session can change the password of their own account or potentially other accounts (if combined with ID manipulation) without knowing the current password.

This leads to full account takeover and persistence.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with low privileges to take over accounts by changing passwords without knowing the original ones.

This can lead to unauthorized access, loss of account control, and potential persistence within the system.

The impact includes confidentiality, integrity, and availability being compromised, as indicated by the CVSS score (8.8) with high impact on all three.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FastGPT to version 4.14.9.5 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated attacker to bypass password verification and potentially take over accounts, leading to unauthorized access and persistence.

Such unauthorized access and account takeover can result in breaches of confidentiality, integrity, and availability of user data.

This can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access.

Useful 0 Not Useful 0