Description
An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| danswer-ai | danswer-ai/danswer | unspecified – ≤ latest | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Danswer - Insecure Direct Object Reference http/cves/2024/CVE-2024-9617.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.