FastGPT S3 Object Access Vulnerability via Unauthorized Key Handling

Detection Guidance

This vulnerability involves unauthorized access to S3 object keys through specific FastGPT endpoints by supplying keys belonging to other teams. Detection would involve monitoring requests to the chat-file presign endpoint and the dataset preview endpoint for suspicious or unauthorized S3 object key parameters.

Specifically, you can look for requests to the chat-file presign endpoint that include S3 keys in the format `chat/<appId>/<uId>/<chatId>/<filename>` where the key does not belong to the caller's team. Similarly, monitor dataset preview endpoint requests with keys in the format `dataset/<datasetId>/<filename>` that may belong to other teams.

Commands to detect such activity would depend on your logging and monitoring setup. For example, if you have access logs for the FastGPT server, you could use grep or similar tools to search for suspicious keys:

• grep -E 'chat/[^/]+/[^/]+/[^/]+/' /path/to/fastgpt/access.log | grep -v '<your_team_id>'
• grep -E 'dataset/[^/]+/' /path/to/fastgpt/access.log | grep -v '<your_team_id>'

Replace `<your_team_id>` with your actual team identifier to filter out legitimate requests. Additionally, monitoring for unusual access patterns or unexpected file downloads from these endpoints could indicate exploitation attempts.

Since the vulnerability allows unauthenticated or low-privilege users to access files from other teams, network intrusion detection systems (NIDS) could be configured to alert on HTTP requests containing suspicious S3 keys or unusual endpoint usage.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in FastGPT, an open source AI knowledge base platform, prior to version v4.15.0-beta5. Two file handlers in FastGPT authorize access to an unrelated resource and then sign or read an S3 object using a key taken directly from the request without verifying that the key belongs to the caller's team.

Since S3 object keys are global within the bucket and only include the tenant ID as a path segment, an attacker can supply another team's key and access that team's file contents through specific endpoints such as the chat-file presign endpoint or the dataset preview endpoint.

This issue was fixed in version v4.15.0-beta5.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can access files belonging to other teams by supplying their S3 object keys, potentially exposing sensitive or confidential information.

Because the vulnerability allows unauthorized read access to data, it can lead to data breaches and compromise confidentiality.

The CVSS score of 8.6 (high severity) indicates a significant risk due to the vulnerability being remotely exploitable without privileges or user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade FastGPT to version v4.15.0-beta5 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to access files belonging to other teams without proper authorization, potentially exposing sensitive data.

Such unauthorized data access could lead to violations of data protection regulations like GDPR or HIPAA, which require strict controls on data confidentiality and access.

Because the vulnerability enables cross-tenant data exposure, it may result in non-compliance with standards mandating tenant data isolation and protection.

Useful 0 Not Useful 0