CyberRota Analysis
AI-GeneratedVersions 5.12.2 through 5.13.3 of the Network-AI package are vulnerable due to a failure to enforce authorization checks on several GET routes, allowing unauthenticated users to access sensitive approval request details. This vulnerability can lead to unauthorized disclosure of critical information, including shell commands and file paths, and is exacerbated by a permissive CORS policy that permits cross-origin resource sharing. Organizations using affected versions should prioritize remediation to protect sensitive data and maintain compliance with security best practices.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.