Authorization Bypass in iFlytek astron-agent Workflow Copy

Executive Summary

This is an authorization bypass vulnerability in the iFlytek astron-agent software through version 1.1.1. It affects the copyFlow endpoint in the WorkflowService component, where the system fails to validate workflow ownership before allowing operations. Authenticated attackers can exploit this by enumerating workflow identifiers and either overwriting other tenants' workflows or copying private workflows to access their definitions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your iFlytek astron-agent instance (v1.1.1 or earlier) exposes the /workflow/copy-flow endpoint without proper authorization checks. Monitor for unauthorized workflow modifications or data exfiltration attempts. Review logs for repeated enumeration of workflow IDs or unusual copy operations targeting other tenants.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows integrity attacks where attackers can sabotage automation by overwriting workflows with malicious content, leading to denial of service or incorrect operations. It also enables confidentiality breaches where attackers can copy and read proprietary workflow definitions from other tenants, exposing sensitive business logic or data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive workflow data, potentially violating GDPR's data protection requirements for confidentiality and integrity. For HIPAA, it may expose protected health information if workflows contain such data, violating security and privacy rules.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of astron-agent beyond v1.1.1. Implement strict ownership and visibility checks in the WorkflowService.copyFlow method. Restrict access to the /workflow/copy-flow endpoint and audit all workflow operations for unauthorized access patterns.

Useful 0 Not Useful 0