Description
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| triggerdotdev | trigger.dev | < 4.5.0 | 4.5.0 |
References
- GitHub Security Advisory (GHSA-pp95-gc86-jq6q) vendor-advisory
- GitHub Security Advisory (GHSA-9fq3-68cw-r7p2) vendor-advisory
- VulnCheck Advisory: Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action third-party-advisory