Summary
Attackers who have already gained access to localhost, even with low privileges, can use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. Might be worse if it's hosted on 0.0.0.0 depending on firewall rules.
PoC
- Install the imap integration and set up Gmail
- Run with "anyquery gpt --host 127.0.0.1 --port 8080"
- Make any SELECT query you'd like to the /execute-query endpoint using curl POST, likely FROM imap_emails
Impact
Anyone who has integrations with sensitive data is affected, the CVSS is much higher if the sensitive data is in local tables
keremergur Reporter
julien040 Remediation developer
Summary
Attackers who have already gained access to localhost, even with low privileges, can use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. Might be worse if it's hosted on 0.0.0.0 depending on firewall rules.
PoC
Impact
Anyone who has integrations with sensitive data is affected, the CVSS is much higher if the sensitive data is in local tables