Authentication Bypass in FastGPT via Dataset ID Manipulation

Executive Summary

This vulnerability exists in FastGPT, an open source AI knowledge base platform, in versions from 4.14.17 to before 4.15.0-beta4. It allows an authenticated tenant user to call a specific API endpoint (POST /api/core/dataset/collection/create/reTrainingCollection) in a way that causes a server-owned datasetId from another tenant to be persisted. This results in mixed dataset objects where ownership is inconsistent, leading to authorization decisions based on incorrect ownership information.

Because of this, users can gain cross-tenant access to read, update, and delete datasets, collections, and training data if they know the mixed object IDs. The issue was fixed in version 4.15.0-beta4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized access across tenants within the FastGPT platform. Specifically, an authenticated user from one tenant can read, modify, or delete datasets, collections, and training data belonging to another tenant if they know the relevant object IDs.

Such unauthorized cross-tenant access can lead to data leakage, data corruption, and loss of data integrity, potentially compromising the confidentiality, integrity, and availability of your data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FastGPT to version 4.15.0-beta4 or later, where the issue is fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated tenant user being able to override the datasetId in the POST /api/core/dataset/collection/create/reTrainingCollection endpoint, causing cross-tenant authorization confusion.

To detect this vulnerability on your system, you can monitor and inspect API calls to the endpoint POST /api/core/dataset/collection/create/reTrainingCollection for requests where the datasetId parameter is provided in the request body and does not match the authenticated tenant's dataset ownership.

Commands or methods to detect this might include:

• Using network traffic capture tools (e.g., tcpdump, Wireshark) to filter HTTP POST requests to /api/core/dataset/collection/create/reTrainingCollection and analyze the request bodies for datasetId values.
• Using application logs or API gateway logs to identify requests where the datasetId in the request body differs from the authenticated tenant's dataset ownership.
• Example command to capture relevant HTTP POST requests with tcpdump (assuming traffic on port 443): tcpdump -A -s 0 'tcp port 443 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'POST /api/core/dataset/collection/create/reTrainingCollection'
• If you have access to the FastGPT server logs, search for entries related to reTrainingCollection creation with datasetId values that do not correspond to the authenticated tenant.

Note that detection requires correlating datasetId values with tenant ownership, which may require custom scripting or log analysis tailored to your environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows cross-tenant read, update, and delete access to datasets due to inconsistent ownership anchors in FastGPT versions before 4.15.0-beta4.

Such unauthorized cross-tenant data access can lead to violations of data privacy and security requirements mandated by common standards and regulations like GDPR and HIPAA, which require strict data segregation and access controls.

Therefore, exploitation of this vulnerability could result in non-compliance with these regulations due to potential unauthorized disclosure or modification of sensitive data belonging to other tenants.

Useful 0 Not Useful 0