OpenObserve 用户 API 中的权限提升漏洞

The impact of CVE-2024-24830 is severe. An attacker, posing as a regular 'member' user, can exploit this vulnerability to gain complete administrative control over an OpenObserve organization. This includes the ability to create new users with root privileges, granting them unrestricted access to sensitive data, configuration settings, and the ability to modify or delete data. This could lead to data breaches, service disruption, and complete compromise of the observability platform. The ease of exploitation, requiring only authentication as a regular user, significantly expands the potential attack surface. This vulnerability shares similarities with other privilege escalation flaws where inadequate input validation allows unauthorized role assignments.

Organizations utilizing OpenObserve for observability, particularly those with multiple users and a tiered access control system, are at risk. Shared hosting environments where multiple tenants share the same OpenObserve instance are especially vulnerable, as a compromised 'member' account in one tenant could potentially be used to escalate privileges across the entire platform. Legacy configurations with default or weak user permissions also increase the risk.

• linux / server:

journalctl -u openobserve -g 'user creation' | grep -i 'root'

• generic web:

curl -I 'https://<openobserve_url>/api/{org_id}/users' | grep -i 'role: root'

• linux / server:

ps aux | grep -i 'openobserve' | grep -i '/api/{org_id}/users'

1. 2024-02-08Disclosure

   disclosure

1. 已保留2024-01-31
2. 发布日期2024-02-08
3. 修改日期2025-08-27
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-24830 is to immediately upgrade OpenObserve to version 0.8.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /api/{org_id}/users endpoint to only authorized administrators. Implement strict role-based access controls (RBAC) to limit the privileges of regular users. Monitor audit logs for suspicious user creation activity, particularly those involving the 'root' role. Consider using a Web Application Firewall (WAF) to filter requests to the vulnerable endpoint and block attempts to manipulate user roles. After upgrading, confirm the fix by attempting to create a new user with elevated privileges as a regular user – the request should be rejected.