Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-1314

CVE-2024-1314:
Kinto Attachment's attachments can be replaced on read-only records

8.6

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-1314
GHSA ID
GHSA-hvp4-vrv2-8wrq
EPSS Score
-
CWE
-
Published
2/8/2024
Updated
2/8/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
kinto-attachmentpip<= 6.3.26.4.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from improper authorization context handling in AttachmentRouteFactory. The pre-patch code didn't set 'self.current_object = existing' when records existed, which is critical for Kinto's authorization policy to distinguish between collection-level and record-level operations. This caused the system to check create permissions on the parent collection (which might be granted via read inheritance) instead of requiring write permissions on the existing record. The patch explicitly sets the current_object context and adds security-focused test cases to validate this behavior.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *tt***m*nt *il* o* *n *xistin* r**or* **n ** r*pl**** i* t** us*r **s `"r***"` p*rmission on on* o* t** p*r*nt (*oll**tion or *u*k*t). *n* i* t** `"r***"` p*rmission is *iv*n to `"syst*m.*v*ryon*"` on on* o* t** p*r*nt, t**n t** *tt*

Reasoning

T** vuln*r**ility st*mm** *rom improp*r *ut*oriz*tion *ont*xt **n*lin* in *tt***m*ntRout****tory. T** pr*-p*t** *o** *i*n't s*t 's*l*.*urr*nt_o*j**t = *xistin*' w**n r**or*s *xist**, w*i** is *riti**l *or Kinto's *ut*oriz*tion poli*y to *istin*uis* *