Information Disclosure in Capgo via Unauthenticated RPC Calls

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 in the public.invite_user_to_org RPC function. It allows unauthenticated attackers to determine whether an organization exists by analyzing different error messages returned by the system. Specifically, attackers can use a SECURITY DEFINER function with a publishable API key to distinguish between 'NO_ORG' and 'NO_RIGHTS' responses, enabling them to enumerate tenants or organizations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to call the public.invite_user_to_org RPC function using a publishable API key and observing the error responses.

If the function returns distinct error messages such as "NO_ORG" for non-existent organizations and "NO_RIGHTS" for existing ones, it indicates the presence of the vulnerability.

A practical detection method is to send requests to the RPC endpoint with various organization IDs and analyze the responses to see if they differ based on organization existence.

Example command using curl (replace <API_URL> and <ORG_ID>):

• curl -X POST <API_URL>/rpc/public.invite_user_to_org -H "apikey: <publishable_api_key>" -H "Content-Type: application/json" -d '{"org_id": "<ORG_ID>"}'

By varying <ORG_ID> and checking if the response error changes between "NO_ORG" and "NO_RIGHTS", you can confirm if the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to information disclosure by allowing attackers to confirm the existence of organizations within the system without authentication. This tenant enumeration can be used as a reconnaissance step for further targeted attacks or exploitation, potentially compromising privacy and security of the affected organizations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to enumerate the existence of organizations by observing distinct error responses from a public API function. Such information disclosure can potentially expose sensitive organizational data or metadata.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, information disclosure vulnerabilities that enable tenant enumeration can increase the risk of unauthorized data access or profiling, which may impact compliance with privacy and data protection regulations.

Mitigations such as removing anonymous access, requiring authentication, returning generic error messages, and rate limiting are recommended to reduce the risk of abuse and help maintain compliance with security best practices often required by such standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing the anonymous ("anon") role grant to the public.invite_user_to_org RPC function to prevent unauthenticated access.

Require authenticated sessions for calling this function to ensure only authorized users can invoke it.

Modify the function to return a generic error response for unknown organizations instead of distinct error messages, preventing attackers from distinguishing organization existence.

Implement rate limiting on the RPC endpoint to reduce the risk of automated enumeration attacks.

Additionally, upgrading to Capgo version 12.128.2 or later, where this vulnerability is fixed, is recommended.

Useful 0 Not Useful 0