GHSA-w9x9-j56r-h98r

@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy

Published

2026-10-29

Modified

2026-10-29

Sources

github-advisory

Summary

## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary `@eeacms/volto-chatbot` exposes an Express middleware route (`**/_v1_da/**`) that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Danswer API, automatically attaching the server-side service credentials (`DANSWER_API_KEY` or session cookie). Because no authorization check, path allowlist, or method restriction is applied before the upstream request is issued, an unauthenticated attacker can invoke arbitrary Danswer API operations — including privileged admin endpoints — as the configured service account. This is a classic Confused Deputy attack: the Volto proxy acts as a deputy that carries credentials on behalf of the attacker. ### Details The vulnerability is introduced across two source files in `@eeacms/[email protected]`. **Route registration (`src/index.js:15`):** ```js middleware.all('**/_v1_da/**', proxyMiddleware); ``` The wildcard pattern matches every HTTP method and any sub-path, and no authentication middleware is chained before `proxyMiddleware`. This means all requests reaching any `/_v1_da/` path are forwarded without any identity check. **Unvalidated path extraction and upstream URL construction (`src/middleware.js:228-230`):** ```js const path = req.url.replace('/_v1_da/', '/'); const reqUrl = `${process.env.DANSWER_URL || ''}/api${path}`; ``` The attacker-controlled `req.url` is transformed into the upstream Danswer path with a simple string replace. There is no allowlist of permitted paths, no restriction on HTTP methods, and no validation of the resulting URL. The attacker therefore fully controls which Danswer endpoint is called and with which HTTP method. **Credential attachment and forwarding (`src/middleware.js:164`, `src/middleware.js:169`, `src/middleware.js:202`):** ```js // Session-cookie path (line 164): headers = { Cookie: cached_auth_cookie, ... } // API-key path (line 169): Authorization: 'Bearer ' + api_key, // Sink — final upstream dispatch (line 202): const response = await fetch(url, options, req.body); ``` After constructing the URL from attacker-supplied input, the middleware attaches the server-side Danswer credentials (either a cached login session cookie or a `Bearer` API key) and dispatches the request. The response from Danswer is then relayed back to the unauthenticated client. **Complete data flow (source → sink):** 1. `src/index.js:15` — all `**/_v1_da/**` paths registered to `proxyMiddleware` with no auth guard (source: external HTTP request). 2. `src/middleware.js:228` — `req.url` used directly to derive the upstream path without allowlist. 3. `src/middleware.js:230` — attacker-controlled path appended to `${DANSWER_URL}/api`. 4. `src/middleware.js:164` / `src/middleware.js:169` — server-side session cookie or API key attached. 5. `src/middleware.js:202` — `fetch(url, options, req.body)` sends the fully-credentialed request to the Danswer backend (sink). This vulnerability is present whenever the add-on middleware is installed and `DANSWER_API_KEY` or `DANSWER_USERNAME`/`DANSWER_PASSWORD` is configured — conditions required for normal, documented operation of the package. ### PoC The following steps reproduce the vulnerability using the Docker-based test harness provided with this report. **Prerequisites:** - Docker installed - Python 3 with the `requests` library **Step 1 — Build the Docker image (from the `npmAI_719_eea__volto-chatbot/` parent directory):** ```bash docker build \ -f vuln-001/Dockerfile \ -t vuln001-proxy \ reports/npmAI_719_eea__volto-chatbot ``` The image packages the unmodified `src/middleware.js` from `@eeacms/[email protected]`, a minimal Express server that wires the vulnerable middleware, and an in-container mock Danswer server that echoes every received request as JSON. The environment variable `DANSWER_API_KEY=supersecret` is set to simulate a real deployment. **Step 2 — S

Affected packages

Remediation: Upgrade to 2.0.4 or later.

References

• https://github.com/advisories/GHSA-w9x9-j56r-h98r