Description
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| uselotus | lotus | ≤ 0.10.2 | — |
References
- https://hackmd.io/@leediay/BkUc3WL2Mx technical-description
- https://github.com/uselotus/lotus/blob/0.10.2/go/event-ingestion/authn/authn.go#L85-L95 technical-description
- https://github.com/uselotus/lotus product
- VulnCheck Advisory: Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix third-party-advisory