AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/security/aut…
disclosure@vulncheck.com
https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2
disclosure@vulncheck.com
https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
disclosure@vulncheck.com
https://github.com/beenuar/AiSOC/security/advisories/GHSA-g4h7-p63q-r8r4
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/aisoc-9.0.0-before-12.0.0-missing-authenti…
disclosure@vulncheck.com