AI Sec Watch

ToolJet is an open-source platform for building internal tools and AI agents. Before version 3.20.178-lts, any authenticated user with a builder role could inject malicious JavaScript code into shared marketplace plugins, allowing them to execute commands on the server with full Node.js access (the ability to run any code the server can run). This malicious code would run whenever anyone on the system used that compromised plugin, compromising the entire ToolJet deployment.

ToolJet, an open-source platform for building internal tools and AI agents, has an SSRF vulnerability (server-side request forgery, where an attacker tricks the server into making unintended HTTP requests) in versions before 3.20.178-lts. The RestAPI data source component only checks hostnames but not the actual IP addresses they resolve to, allowing attackers to use specially crafted domain names like 169.254.169.254.nip.io to reach Azure IMDS (Azure Instance Metadata Service, which stores sensitive cloud credentials) and steal authentication tokens for production systems.

ToolJet, an open-source platform for building internal tools and AI agents, had a security flaw in versions before 3.20.1780-lts where an authenticated endpoint (POST /api/data-sources/decrypt) could decrypt sensitive database credentials for any organization if you knew the credential ID, even if you weren't part of that organization. This is a cross-tenant confidentiality breach (unauthorized access to another organization's secrets) because the endpoint lacked proper security checks that other similar endpoints had.

LibreChat, a ChatGPT-like application supporting multiple AI providers, has a vulnerability in versions before 0.8.4-rc1 where the 2FA backup code regeneration endpoint doesn't verify the user's identity. An attacker with a stolen session token (a credential that keeps you logged in) can regenerate a victim's two-factor authentication backup codes and use them to bypass login security or disable 2FA entirely.

LibreChat, a tool that lets users chat with multiple AI providers, had an incomplete security fix. While developers added rate limiters (controls that limit how many requests can be made in a short time) to one endpoint called /fork to stop users from duplicating conversations too quickly, they forgot to add the same protection to a similar endpoint called /duplicate, which does the same resource-heavy database work. An authenticated user (someone with a valid login) could exploit this gap by using /duplicate instead of /fork to overwhelm the server.

LibreChat, a ChatGPT-like tool that works with multiple AI providers, had a security flaw in versions before 0.8.4-rc1 where authenticated users could configure custom API endpoints without proper validation, potentially allowing them to access internal network addresses through SSRF (server-side request forgery, where a server is tricked into making requests to unintended targets).

LibreChat, a ChatGPT-like application that works with multiple AI providers, has a vulnerability in versions before 0.8.5 where it fails to validate the resource parameter from OAuth (a system for securely sharing access between applications) metadata, allowing a malicious server to steal access tokens meant for legitimate servers. This is an origin validation error (CWE-346, where the system fails to check that data comes from the expected source).

LibreChat (a ChatGPT alternative that works with multiple AI services) has a vulnerability in versions before 0.8.4-rc1 where the message deletion API endpoint doesn't properly check ownership, allowing any logged-in user to permanently delete another user's messages by providing their own conversation ID along with someone else's message ID.

LibreChat, a ChatGPT-like application that works with multiple AI providers, has a vulnerability in its image upload feature (the POST /api/files/images endpoint) that allows any logged-in user to upload files to another user's agent tools without permission. The developers had previously added permission checks to a file upload route, but forgot to add the same checks to the image upload route, making it easy for attackers to bypass the security by using images instead of regular files. This issue is fixed in version 0.8.4-rc1.