OpenObserve में Users API में विशेषाधिकार वृद्धि भेद्यता

The impact of CVE-2024-24830 is severe. An attacker, posing as a regular 'member' user, can exploit this vulnerability to gain complete administrative control over an OpenObserve organization. This includes the ability to create new users with root privileges, granting them unrestricted access to sensitive data, configuration settings, and the ability to modify or delete data. This could lead to data breaches, service disruption, and complete compromise of the observability platform. The ease of exploitation, requiring only authentication as a regular user, significantly expands the potential attack surface. This vulnerability shares similarities with other privilege escalation flaws where inadequate input validation allows unauthorized role assignments.

Organizations utilizing OpenObserve for observability, particularly those with multiple users and a tiered access control system, are at risk. Shared hosting environments where multiple tenants share the same OpenObserve instance are especially vulnerable, as a compromised 'member' account in one tenant could potentially be used to escalate privileges across the entire platform. Legacy configurations with default or weak user permissions also increase the risk.

• linux / server:

journalctl -u openobserve -g 'user creation' | grep -i 'root'

• generic web:

curl -I 'https://<openobserve_url>/api/{org_id}/users' | grep -i 'role: root'

• linux / server:

ps aux | grep -i 'openobserve' | grep -i '/api/{org_id}/users'

1. 2024-02-08Disclosure

   disclosure

1. आरक्षित2024-01-31
2. प्रकाशित2024-02-08
3. संशोधित2025-08-27
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-24830 is to immediately upgrade OpenObserve to version 0.8.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /api/{org_id}/users endpoint to only authorized administrators. Implement strict role-based access controls (RBAC) to limit the privileges of regular users. Monitor audit logs for suspicious user creation activity, particularly those involving the 'root' role. Consider using a Web Application Firewall (WAF) to filter requests to the vulnerable endpoint and block attempts to manipulate user roles. After upgrading, confirm the fix by attempting to create a new user with elevated privileges as a regular user – the request should be rejected.