Rhino Security Labs report multiple flaws in default install of Appsmith Enterprise Platform
Take action: If you are running Appsmith, it's time to patch the system. Even if it's only accessible internally, there are several unauthenticated attacks and even a denial of service vector that can be easily abused, both by disgruntled insiders and as target of opportunity for hackers.
Learn More
Rhino Security Labs has uncovered a series of vulnerabilities affecting default installations of the Appsmith Enterprise platform.
Appsmith is an open-source developer tool designed to help engineers build internal business applications quickly using pre-built components and integrations. It allows for faster development of complex web applications compared to traditional coding methods.
Three significant security flaws were identified:
- CVE-2024-55963 (CVSS score not available): An unauthenticated remote code execution vulnerability due to a misconfigured PostgreSQL database included by default in Appsmith installations. The included PostgreSQL database has a misconfigured authentication setup in the pg_hba.conf file that allows any local user to connect as any PostgreSQL user (including superuser) without password authentication due to the "trust" authentication method. Appsmith's default configuration allows for user signup without invitation, enabling attackers to create their own workspaces and connect to the misconfigured database.
- CVE-2024-55964 (CVSS score not available): An Insecure Direct Object Reference (IDOR) vulnerability allowing "App Viewer" users unauthorized access to sensitive database data through SQL queries. The "/api/v1/datasources/[datasource-id]/schema-preview" API endpoint, which lacks proper authorization checks. Exploitation of predictable datasource ID generation patterns with only 5 characters to bruteforce.
- CVE-2024-55965 (CVSS score not available): A denial-of-service vulnerability via broken access control allowing "App Viewer" users to access the 'Restart' API functionality.
These vulnerabilities impact Appsmith Community, Business, and Enterprise Editions, versions 1.20 through 1.51.
All users running self-hosted Appsmith instances should immediately upgrade to version 1.52 or later.
