Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/chatwoot/chatwoot/commit/8dd0d08322edafaec24624b72ed2f604592…
disclosure@vulncheck.com
https://github.com/chatwoot/chatwoot/issues/15072
disclosure@vulncheck.com
https://github.com/chatwoot/chatwoot/pull/15039
disclosure@vulncheck.com
https://github.com/chatwoot/chatwoot/releases/tag/v4.16.0
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/chatwoot-unauthenticated-activestorage-dir…
disclosure@vulncheck.com