Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-9617IDOR in danswer-ai/danswer
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in danswer-ai/danswer from danswer-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.0)6.5Medium
Exploit odds (30 days)1.7%top 22.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| danswer-ai | danswer-ai/danswer | unspecified – through latest |
Weakness: CWE-639 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N