Description
AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve threat-intelligence results and set force to true to consume commercial provider API quota.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| beenuar | AiSOC | 12.1.0 <23.3.0 | — |
References
- https://github.com/beenuar/AiSOC/security/advisories/GHSA-qf6m-hgwv-65f9
- https://github.com/beenuar/AiSOC/commit/3a853d16b09a4c59fb4fc3fbe20938bb4c306be7
- https://github.com/beenuar/AiSOC/pull/1844
- https://github.com/beenuar/AiSOC/releases/tag/v23.3.0
- https://github.com/beenuar/AiSOC/blob/4d8790e21489bffdb33bdbd1ea9ea712899efaf9/apps/web/next.config.js#L305-L310
- https://www.vulncheck.com/advisories/aisoc-12.1.0-before-23.3.0-missing-authentication-via-enrichment-console-proxy-routes