Capgo API Key Validity Oracle and User UUID Disclosure

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves unauthenticated security definer RPC functions named get_user_id and get_org_perm_for_apikey.

These functions expose API key validity oracles and user UUID disclosure, allowing unauthenticated attackers to use the public API key to validate leaked API keys, enumerate users and applications, and determine permission levels.

This significantly increases the usefulness of compromised credentials for attackers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to invoke the unauthenticated RPC functions `get_user_id` and `get_org_perm_for_apikey` using the public API key on your Capgo instance. By sending requests to these functions, you can check if they return valid user UUIDs or permission information without authentication.

For example, you can use curl or similar HTTP clients to call these RPC endpoints with various API keys to see if the responses indicate valid keys or reveal user and permission data.

• Use curl to call `get_user_id` with an API key: `curl -X POST https://<your-capgo-endpoint>/rpc/get_user_id -H "apikey: <public_api_key>" -d '{"apikey": "<test_api_key>"}'`
• Use curl to call `get_org_perm_for_apikey` with an API key: `curl -X POST https://<your-capgo-endpoint>/rpc/get_org_perm_for_apikey -H "apikey: <public_api_key>" -d '{"apikey": "<test_api_key>"}'`

If these commands return user UUIDs, permission strings, or other data instead of errors or null, your system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthenticated attackers to validate leaked API keys, enumerate users and applications, and determine permission levels without any authentication.

This means attackers can confirm which API keys are valid and understand the scope of access those keys provide, increasing the risk of unauthorized access and misuse of your system.

As a result, compromised credentials become more actionable, potentially leading to data exposure or unauthorized operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes sensitive information such as user UUIDs and API key validity without authentication, which can lead to unauthorized access and enumeration of users and applications.

Such exposure of sensitive information can increase the risk of data breaches and unauthorized data access, potentially impacting compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

By enabling attackers to validate leaked API keys and determine permission levels, the vulnerability raises the likelihood of unauthorized data access, which may violate principles of confidentiality and data minimization mandated by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Capgo to version 12.128.2 or later, where this vulnerability has been patched.

Until the upgrade can be performed, restrict access to the vulnerable RPC functions `get_user_id` and `get_org_perm_for_apikey` by disabling or limiting their execution to authenticated users only.

Additionally, review and rotate any potentially compromised API keys, especially public API keys, to prevent unauthorized use.

Useful 0 Not Useful 0