Vulnerabilidade de Acesso Não Autorizado no OpenObserve em Users API

The impact of CVE-2024-25106 is severe due to its potential for complete organizational control compromise. An attacker, possessing even a low-privilege account within an OpenObserve organization, can leverage this vulnerability to remove all other users, including those with administrative privileges. This effectively grants the attacker full control over the OpenObserve instance, enabling them to access sensitive data, modify configurations, and potentially pivot to other systems within the organization. The ability to remove root users bypasses all standard access controls, making this a high-impact privilege escalation vulnerability. This is akin to a complete takeover of the observability platform, potentially exposing critical operational data and hindering incident response capabilities.

Organizations utilizing OpenObserve for observability and monitoring are at risk, particularly those with multiple users and a reliance on the platform for critical operational insights. Environments with shared hosting configurations or those that have not implemented robust access control policies are especially vulnerable, as a compromised low-privilege account could be leveraged to gain complete control.

• linux / server:

journalctl -u openobserve -g "user removal"

• generic web:

curl -s -X DELETE "http://openobserve/api/{org_id}/users/{email_id}" | grep -i "success"

• generic web:

 grep -i "user removal" /var/log/nginx/access.log

1. 2024-02-08Disclosure

   disclosure

1. Reservado2024-02-05
2. Publicada2024-02-08
3. Modificada2024-08-01
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-25106 is to immediately upgrade OpenObserve to version 0.8.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restricting access to the /api/{orgid}/users/{emailid} endpoint using network firewalls or access control lists (ACLs) can limit the attack surface. Carefully review user permissions and ensure the principle of least privilege is enforced. Monitor OpenObserve logs for suspicious user activity, particularly attempts to modify user accounts. While a direct WAF rule is difficult to implement without deep inspection of the request payload, monitoring for unusual user deletion patterns could provide an early warning signal.