0.8.1
A critical vulnerability (CVE-2024-25106) has been discovered in OpenObserve, an observability platform designed for petabyte-scale log, metric, and trace analysis. This vulnerability resides in the /api/{orgid}/users/{emailid} endpoint and allows authenticated users within an organization to remove any other user, regardless of their role, including administrators. The vulnerability impacts OpenObserve versions 0.7.9 and earlier, and a fix is available in version 0.8.0.
The impact of CVE-2024-25106 is severe due to its potential for complete organizational control compromise. An attacker, possessing even a low-privilege account within an OpenObserve organization, can leverage this vulnerability to remove all other users, including those with administrative privileges. This effectively grants the attacker full control over the OpenObserve instance, enabling them to access sensitive data, modify configurations, and potentially pivot to other systems within the organization. The ability to remove root users bypasses all standard access controls, making this a high-impact privilege escalation vulnerability. This is akin to a complete takeover of the observability platform, potentially exposing critical operational data and hindering incident response capabilities.
CVE-2024-25106 was publicly disclosed on February 8, 2024. The vulnerability is not currently listed on the CISA KEV catalog, but its critical severity warrants close monitoring. Public proof-of-concept exploits are not yet widely available, but the ease of exploitation, given the requirement of only an authenticated user account, suggests a high probability of exploitation if left unpatched. The vulnerability's impact on observability data makes it a particularly attractive target for malicious actors seeking to disrupt operations or exfiltrate sensitive information.
Organizations utilizing OpenObserve for observability and monitoring are at risk, particularly those with multiple users and a reliance on the platform for critical operational insights. Environments with shared hosting configurations or those that have not implemented robust access control policies are especially vulnerable, as a compromised low-privilege account could be leveraged to gain complete control.
• linux / server:
journalctl -u openobserve -g "user removal"• generic web:
curl -s -X DELETE "http://openobserve/api/{org_id}/users/{email_id}" | grep -i "success"• generic web:
grep -i "user removal" /var/log/nginx/access.logdisclosure
漏洞利用状态
EPSS
0.08% (25% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2024-25106 is to immediately upgrade OpenObserve to version 0.8.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restricting access to the /api/{orgid}/users/{emailid} endpoint using network firewalls or access control lists (ACLs) can limit the attack surface. Carefully review user permissions and ensure the principle of least privilege is enforced. Monitor OpenObserve logs for suspicious user activity, particularly attempts to modify user accounts. While a direct WAF rule is difficult to implement without deep inspection of the request payload, monitoring for unusual user deletion patterns could provide an early warning signal.
将 OpenObserve 更新到 0.8.0 或更高版本。此版本修复了允许未经授权的用户删除其他用户的授权漏洞。更新将防止未经授权的访问和潜在的运营中断。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2024-25106 is a critical vulnerability in OpenObserve versions ≤0.7.9 that allows authenticated users to remove any other user, including administrators, potentially granting unauthorized access and control.
If you are running OpenObserve version 0.7.9 or earlier, you are affected by this vulnerability and should prioritize upgrading to a patched version.
The recommended fix is to upgrade to OpenObserve version 0.8.0 or later. Temporary workarounds include restricting access to the vulnerable endpoint and reviewing user permissions.
While no active exploitation has been publicly confirmed, the vulnerability's ease of exploitation and critical severity suggest a high probability of exploitation if left unpatched.
Refer to the OpenObserve security advisory for detailed information and updates: [https://github.com/openobserve/openobserve/security/advisories/GHSA-9g7x-x453-4444](https://github.com/openobserve/openobserve/security/advisories/GHSA-9g7x-x453-4444)
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
上传你的 go.mod 文件，立即知道是否受影响。