CVE-2024-52294

Summary

CVE-2024-52294 is a vulnerability affecting the Khoj self-hostable AI app before version 1.29.10. The update_subscription endpoint contained an Insecure Direct Object Reference (IDOR) issue, allowing authenticated users to manipulate other users' Stripe subscriptions by altering the email parameter. This vulnerability existed in the subscription endpoint at `/api/subscription`. The email parameter was used as a direct reference to user subscriptions without verification of object ownership, bypassing any authorization checks. This issue was resolved in version 1.29.10, with support for arbitrarily presenting emails for update being deprecated.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.