Capgo Authorization Bypass Vulnerability in Manifest Insertion Allowing OTA Metadata Poisoning

An authorization bypass vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows read-only organization members to insert rows into the public.manifest table, which stores over-the-air (OTA) update metadata. The inserted rows can include malicious entries with arbitrary S3 path values. These entries are then served to devices via the unauthenticated /updates endpoint, potentially leading to OTA metadata poisoning and the delivery of malicious assets. The issue arises from a mismatch in authorization, as the manifest insertion policy only checks for organizational membership and does not require upload or write permissions, allowing low-privileged users to modify live update metadata.

Impact

Exploitation of this vulnerability allows read-only organization members to unauthorizedly modify OTA update metadata, which is then delivered to app devices. This could lead to the injection of malicious assets or JavaScript, bypassing intended privilege boundaries that restrict such modifications to users with upload or write capabilities.

Reproduction

To reproduce this vulnerability, a read-only organization member JWT can be used to insert a manifest entry into the public.manifest table. After the entry is inserted, it can be retrieved through the /updates endpoint, which will serve the injected manifest entry as a download URL for the specified app version.

Remediation

The recommended fix is to restrict the public.manifest insert and delete policies to users with upload or write permissions. Additionally, it is advised to validate that the manifest.s3_path corresponds to the correct app and version storage prefix, and to reject entries for deleted or non-live versions unless explicitly intended.