Description
ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HoshinoSuzumi | chronoframe | ≤ 1.0.0 | — |
References
- https://hackmd.io/@hieuPenguinnn/chronoframe-unauthenticated-wizard-config-takeover third-party-advisory
- https://github.com/HoshinoSuzumi/chronoframe/blob/v1.0.0/server/api/wizard/storage.post.ts#L1-L26 technical-description
- https://github.com/HoshinoSuzumi/chronoframe product
- VulnCheck Advisory: ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API third-party-advisory