IDOR via Delimiter Injection allows Session Renaming of any user

Sanitize_invalid_platform_IDs_on_load-2bbe0107-Session-Renaming-ISSUE-REPORT.md

Advisory Details

Title: IDOR via Delimiter Injection allows Session Renaming of any user

Description:

Summary

An Insecure Direct Object Reference (IDOR) vulnerability caused by delimiter injection exists in AstrBot's WebChat session handling. Any authenticated user can inject a delimiter character (!) into their session_id to trick the server into associating their actions with a different user's session. This allows an attacker to arbitrarily rename the display title of any other user's session in the database, impacting data integrity and user isolation.

Details

The vulnerability stems from an unsafe string splitting operation when processing the session identifier from WebChat events.

In astrbot/core/astr_main_agent.py, the system attempts to extract the underlying WebChat session ID by splitting the internal event session ID on the ! character and blindly taking the last segment:

chatui_session_id = event.session_id.split("!")[-1]

The internal event.session_id is constructed by concatenating the adapter prefix, username, and the user-supplied session_id (or cid) using the ! delimiter (e.g., webchat!user!cid).

Because the session_id from the external WebSocket or WebChat API request is attacker-controlled and lacks validation against containing the delimiter !, an attacker can supply a crafted session_id like attacker!victim_session_id. When concatenated, the string becomes webchat!attacker_user!attacker!victim_session_id.

When the backend extracts the ID using .split("!")[-1], it incorrectly takes victim_session_id instead of the attacker's actual CID. Subsequently, when the LLM auto-generates a session title (or when the user manually issues a rename command like //rename), the backend updates the platform_sessions.display_name record associated with victim_session_id. This allows any authenticated user to arbitrarily modify the metadata of another user's session.

PoC

Prerequisites

• An AstrBot instance with Dashboard/Live Chat functionality enabled.
• The attacker must be able to log in to the Dashboard via /api/auth/login to obtain an authentication token.
• The target's session_id (e.g., a UUID like 124f0bee-916d-400f-bb49-ce5651ab0352) must be known, enumerated, or observable.

Reproduction Steps

1. Download the fake OpenAI server script from: fake_openai_server.py
2. Download the PoC exploit script from: poc_exploit.py
3. Download the control script from: control-normal_session_id.py
4. Start a local instance of AstrBot connected to the fake OpenAI server for determinism.
5. Run the exploit script python3 poc_exploit.py. The script will:
   • Log in and get a token.
   • Create a victim session.
   • Connect to the WebSocket /api/unified_chat/ws and send a message with session_id set to attacker!{victim_session_id} and message set to //rename EXPLOIT_RENAMED.
   • Verify in the SQLite database that the victim's display_name was changed to EXPLOIT_RENAMED.
6. (Optional) Run python3 control-normal_session_id.py to verify that without the delimiter injection, a normal attacker session ID does not affect the victim's session.

Log of Evidence

victim_session_id=124f0bee-916d-400f-bb49-ce5651ab0352
crafted_attacker_session_id=attacker!124f0bee-916d-400f-bb49-ce5651ab0352
victim_display_name=EXPLOIT_RENAMED
Independent database verification:
('124f0bee-916d-400f-bb49-ce5651ab0352', 'astrbot', 'webchat', 'EXPLOIT_RENAMED')

Impact

This is an Insecure Direct Object Reference (IDOR) vulnerability that leads to unauthorized data modification. Any authenticated attacker can overwrite the session titles of any user on the platform. This impacts data integrity, potentially causes confusion among users, disrupts audits, and breaks downstream automation flows relying on session metadata.

Affected products

• Ecosystem: python
• Package name: AstrBot
• Affected versions: <= v4.24.2
• Patched versions:

Severity

• Severity: Medium
• Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses

• CWE: CWE-639: Authorization Bypass Through User-Controlled Key

Occurrences

Permalink	Description
https://github.com/AstrBotDevs/AstrBot/blob/67c7445d253846c232477a1ebcb2823a522a029c/astrbot/core/astr_main_agent.py#L889-L925	The chatui_session_id is extracted using an unsafe split("!")[-1] operation on attacker-controlled event.session_id which allows injecting a victim's session ID and incorrectly updating their session title in update_platform_session.