Executive Summary

This vulnerability exists in TransformerOptimus SuperAGI versions up to 0.0.14, specifically in the get_budget and update_budget functions within the superagi/controllers/budget.py file of the Budget Endpoint component.

The issue allows an attacker to bypass authorization controls, meaning they can manipulate budget-related functions without proper permissions.

The attack can be launched remotely, and there is a publicly available exploit that could be used to take advantage of this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access and manipulation of budget-related functions in the affected software.

An attacker exploiting this flaw could bypass authorization controls remotely, potentially altering budget data or operations without permission.

Such unauthorized actions could result in financial discrepancies, data integrity issues, or misuse of resources managed by the Budget Endpoint.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized users to access and modify budget data belonging to any organization without proper authorization checks.

Such unauthorized access and manipulation of sensitive financial data could lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict controls over access to personal and organizational data.

Specifically, the lack of authorization checks may result in unauthorized disclosure and alteration of sensitive information, undermining confidentiality and integrity requirements mandated by these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the budget management endpoints of the SuperAGI application for authorization bypass issues. Specifically, you can attempt to access or modify budgets belonging to other organizations using valid authentication tokens but without proper ownership verification.

Proof of Concept (PoC) commands include sending HTTP requests with a valid JWT token to the following endpoints:

• GET request to /api/budgets/get/{budget_id} to read any organization's budget.
• PUT request to /api/budgets/update/{budget_id} with JSON data to modify any organization's budget.

For example, using curl commands:

• curl -H "Authorization: Bearer <valid_jwt_token>" https://<target>/api/budgets/get/123
• curl -X PUT -H "Authorization: Bearer <valid_jwt_token>" -H "Content-Type: application/json" -d '{"budget":0,"cycle":"new_cycle"}' https://<target>/api/budgets/update/123

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the affected budget endpoints to only authorized users who own the budgets they are trying to access or modify.

Since the vulnerability arises from missing organization ownership checks, you should implement or enforce authorization checks that verify the budget belongs to the authenticated user's organization before allowing read or update operations.

Additionally, monitor and audit access logs for unusual activity such as attempts to enumerate budget IDs or unauthorized modifications.

If possible, temporarily disable or restrict access to the budget management endpoints until a proper fix or patch is applied.

Useful 0 Not Useful 0