Email and WeChat Binding CSRF in New API

Executive Summary

This vulnerability exists in the New API, a large language model gateway and AI asset management system, prior to version 0.12.0-alpha.1. The issue involves the use of GET requests for state-changing operations on email and WeChat account binding endpoints (GET /api/oauth/email/bind and GET /api/oauth/wechat/bind). Because GET requests were used, an attacker could trick a logged-in user's browser into binding an attacker-controlled email address or OAuth identity if session cookies were sent on cross-site navigations.

This means that an attacker could potentially hijack or manipulate account bindings by exploiting the way these endpoints handle requests.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized binding of attacker-controlled email addresses or OAuth identities to a victim's account. This could allow attackers to gain some level of control or influence over the victim's account by associating their own credentials with it.

Since the vulnerability requires the victim to be logged in and involves cross-site navigations where session cookies are sent, it could be exploited to perform account manipulation without the victim's explicit consent.

The CVSS score of 5.3 indicates a medium severity impact, with high impact on integrity but no impact on confidentiality or availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the New API system to version 0.12.0-alpha.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves a Cross-Site Request Forgery (CSRF) issue that allows an attacker to bind an attacker-controlled email address or OAuth identity to a logged-in user's account. This could potentially lead to unauthorized account modifications.

However, there is no explicit information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of GET requests for state-changing operations on the endpoints /api/oauth/email/bind and /api/oauth/wechat/bind in versions prior to 0.12.0-alpha.1. To detect if your system is vulnerable, you can monitor network traffic or logs for GET requests to these endpoints that include query parameters related to email or OAuth binding.

One approach is to use network traffic inspection tools like tcpdump or Wireshark to capture HTTP GET requests to these endpoints.

• Using tcpdump to capture GET requests to the vulnerable endpoints: tcpdump -i <interface> -A 'tcp port 80 or tcp port 443' | grep 'GET /api/oauth/email/bind'
• Similarly, for WeChat binding endpoint: tcpdump -i <interface> -A 'tcp port 80 or tcp port 443' | grep 'GET /api/oauth/wechat/bind'

Alternatively, if you have access to web server logs, you can search for GET requests to these endpoints with query parameters indicating binding attempts.

• Example command to search logs: grep 'GET /api/oauth/email/bind' /var/log/nginx/access.log
• grep 'GET /api/oauth/wechat/bind' /var/log/nginx/access.log

Blocking or alerting on such GET requests to these endpoints can help detect exploitation attempts or presence of the vulnerability.

Useful 0 Not Useful 0