CVE-2024-8026
Published: 20 March 2025
Description
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
Security Summary
CVE-2024-8026 is a Cross-Site Request Forgery (CSRF) vulnerability in the backend API of netease-youdao/qanything, present as of commit d9ab8bc. The issue arises from overly permissive CORS headers on the backend server, which allow all cross-origin calls. This affects all backend endpoints, enabling unauthorized actions such as creating, uploading, listing, deleting files, and managing knowledge bases. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) and maps to CWE-352.
An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) with low complexity (AC:L), but it requires user interaction (UI:R), such as tricking a victim into visiting a malicious site while authenticated to the backend. Exploitation allows the attacker to perform actions on the victim's behalf across all endpoints, resulting in high integrity (I:H) and availability (A:H) impacts, including arbitrary file operations and knowledge base modifications, with no direct confidentiality loss (C:N).
Mitigation guidance is available in the Huntr.com advisory at https://huntr.com/bounties/e57f1e32-0fe5-4997-926c-587461aa6274, where the vulnerability was reported. Security practitioners should consult this reference for patch details or recommended fixes, such as restricting CORS headers.
Details
- CWE(s)
Affected Products
AI Security Analysis
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- MITRE ATLAS Techniques
- None mapped
- Classification Reason
- qanything (netease-youdao/qanything) is an open-source AI-native multi-modal search and RAG framework with knowledge base management, fitting Enterprise AI Assistants; vulnerability reported on AI/ML bug bounty platform (huntr.com).
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CSRF with permissive CORS enables cross-origin exploitation (T1190) of backend API for file/knowledge base operations, facilitating file discovery (T1083), data collection from repositories like knowledge bases (T1213), file deletion (T1070.004), and stored data manipulation via upload/create (T1565.001).