waooAI waoowaoo Improper Authentication Vulnerability in Internal Task Header Handler

A vulnerability allowing improper authentication has been identified in waooAI waoowaoo versions through 0.4.1. The issue arises in the Internal Task Header Handler component, specifically within the getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight functions in src/lib/api-auth.ts. The vulnerability is triggered by manipulating the x-internal-user-id request header, which can lead to unauthorized user impersonation. This flaw can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows an unauthenticated attacker to impersonate a user by forging user sessions. This bypasses authentication and authorization checks, granting access to authenticated API routes as the impersonated user. Potential impacts include unauthorized access to user data, project information, and the ability to consume resources through task generation APIs.

Reproduction

To reproduce this vulnerability, ensure the application is accessible over the network and that the target user's UUID is known. The vulnerability can be exploited if the INTERNAL_TASK_TOKEN is unset and the NODE_ENV is not set to production, or if the INTERNAL_TASK_TOKEN is set to a value known by the attacker, such as the public default token in the repository. Once these conditions are met, send a request to an API endpoint that requires authentication, including the x-internal-user-id header with the UUID of the user to impersonate. If the request is accepted and the session.user.id is set to the impersonated user's UUID, the vulnerability has been successfully exploited.

Remediation

Users are advised to set a high-entropy INTERNAL_TASK_TOKEN, avoid using default/example tokens, and strip or reject x-internal-user-id headers from external requests unless they come from a trusted internal source.