Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

quivrhq/quivr

              main @ 947a785
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

backend/routes/brain_routes.py: most-fixed (4 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring failures to enforce consistent RBAC (Viewer, Editor, Owner) on brain-related endpoints allow unauthorized users to modify, retrieve, or delete internal brains. Mitigation requires consistent application of 'validate_brain_authorization' or 'has_brain_authorization' dependencies.

Path Traversal: Insufficient validation of user-supplied filenames allows attackers to traverse directory paths on destination buckets or servers during upload operations, as highlighted by CVE-2024-6583. Filenames must be early-sanitized using strict alphanumeric filters.

Auth Bypass: Endpoints driving chat generation and question stream dispatching failed to validate whether the current user possessed authorized access to the targeted 'brain_id', exposing conversation context to unprivileged users.