Windmill Missing Authorization Exposes Job Data

Executive Summary

This is a missing authorization vulnerability in Windmill Labs Windmill through version 1.783.0. Authenticated operators can write job progress and read job metrics for any job in the workspace, even if they do not own the job. The vulnerability occurs because the job_metrics handlers lack proper authorization checks, bypassing workspace-level access controls.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking Windmill's job metrics and progress handlers for unauthorized access. Monitor logs for requests to /api/job_metrics or similar endpoints from non-owner operators. Look for unusual progress updates or metrics reads on jobs outside the operator's workspace.

Useful 0 Not Useful 0

Impact Analysis

An attacker with operator access could monitor sensitive job execution data from other jobs and inject misleading progress updates. This could lead to unauthorized access to job details, potential data leaks, and disruption of job operations within the workspace.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive job data, potentially exposing personal or confidential information. It may lead to breaches of GDPR (data protection) or HIPAA (healthcare data privacy) if job metrics contain regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Windmill to a patched version beyond 1.783.0. Implement strict access controls for job metrics endpoints. Review and restrict operator permissions to only necessary workspace resources. Audit logs for suspicious activity related to job metrics access.

Useful 0 Not Useful 0