OpenObserve Onjuiste Autorisatie Maakt Het Mogelijk voor Admin Gebruiker om Root Gebruiker te Verwijderen

The impact of CVE-2024-55954 is significant. An attacker who has gained "Admin" privileges within an OpenObserve organization can exploit this vulnerability to remove the "Root" user, which holds the highest level of access. By eliminating the Root user, the attacker can effectively gain full control over the organization's OpenObserve instance, potentially leading to data breaches, unauthorized modifications, and disruption of observability services. This vulnerability presents a serious risk to organizations relying on OpenObserve for monitoring and troubleshooting.

Organizations heavily reliant on OpenObserve for observability and monitoring are at significant risk. Specifically, deployments with poorly configured role-based access controls, where Admin accounts have excessive privileges, are particularly vulnerable. Shared hosting environments utilizing OpenObserve also face increased risk due to potential cross-tenant access issues.

• linux / server: Monitor OpenObserve API logs for requests to /api/{orgid}/users/{emailid} with the removeuserfrom_org function originating from users with the 'Admin' role. Look for unusual patterns or unexpected user removals.

journalctl -u openobserve -f | grep 'remove_user_from_org'

• generic web: Use curl to test the API endpoint /api/{orgid}/users/{emailid} with an Admin user's credentials to see if a Root user can be removed.

curl -X DELETE -H "Authorization: Bearer <admin_token>" https://<openobserve_url>/api/<org_id>/users/<root_email>

1. 2025-01-16Disclosure

   disclosure

1. Gereserveerd2024-12-13
2. Gepubliceerd2025-01-16
3. Gewijzigd2025-02-12
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-55954 is to upgrade OpenObserve to version 0.14.1 or later, which includes the necessary privilege check fixes. If immediate upgrading is not possible, consider implementing stricter role-based access controls within OpenObserve to limit the potential impact of a compromised Admin account. Review existing user permissions and ensure that the principle of least privilege is enforced. While a direct WAF rule is unlikely to be effective, monitoring for unusual user removal activity within the OpenObserve API logs can provide early warning signs of exploitation.