SuperAGI execution configuration cross-organization disclosure

[Ro1ME]

⚠️ Check for existing issues before proceeding. ⚠️

• I have searched the existing issues, and there is no existing issue for my problem

Where are you using SuperAGI?

Linux

Which branch of SuperAGI are you using?

Main

Do you use OpenAI GPT-3.5 or GPT-4?

GPT-3.5

Which area covers your issue best?

Installation and setup

Describe your issue.

SuperAGI's agent execution configuration controller endpoint allows authenticated users from one organization to retrieve execution configuration details for agents belonging to a different organization. The endpoint accepts agent_id and agent_execution_id parameters but does not verify that these resources belong to the authenticated user's organization.

Affected Endpoint:

• GET /api/agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id} - get_agent_execution_configuration at superagi/controllers/agent_execution_config.py:24

Vulnerability Type: Improper Access Control (CWE-284)

Impact: An attacker with valid credentials can view execution configurations of agents belonging to other organizations, leading to:

• Disclosure of agent configuration parameters
• Exposure of API keys, credentials, and secrets in configurations
• Information about tools and resources used by victim agents
• Model configurations and prompt templates
• Privacy violation of execution settings

How to replicate your Issue?

Prerequisites:

1. Deploy SuperAGI instance with multi-organization support
2. Create two organizations: Organization A (victim) and Organization B (attacker)
3. Create user accounts in both organizations
4. Set up Burp Suite proxy at 127.0.0.1:8080

Reproduction Steps:

1. Setup victim data:

   • Log in to SuperAGI as Organization A user
   • Create a project with an agent
   • Run the agent to generate an execution record
   • Note the agent_id and agent_execution_id (visible in browser network requests or execution details page)

2. Capture baseline request:

   • Log in to SuperAGI as Organization B user (attacker)
   • Navigate to one of your own agent's execution configuration
   • Open browser developer tools (Network tab) or use Burp Suite
   • Observe the request to /api/agent_executions_configs/details/agent_id/{id}/agent_execution_id/{id}

3. Exploit the vulnerability:

   • In Burp Suite Repeater (or modify the request in browser):
   • Keep the Organization B user's authentication token/cookie
   • Replace both {agent_id} and {agent_execution_id} in the URL path with Organization A's values
   • Send the GET request

4. Verify the impact:

   • The request succeeds with HTTP 200 response
   • The response body contains Organization A's execution configuration with sensitive details
   • Organization B user successfully accessed Organization A's configuration data without authorization

Upload Error Log Content

No error logs