CVE-2024-9617

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94

Description The issue allows an attacker to view any files due to a lack of verification of whether the attacker is the creator of the file. This can be exploited by directly calling the GET /api/chat/file/{file id} interface to view any user's file. The file id variable is used in this process.

Recommendations For danswer-ai/danswer version 0.3.94, consider restricting access to the GET /api/chat/file/{file id} interface until a patch is available, or implement a verification mechanism to ensure only the file creator can access the file.