Authentication Bypass in Cheshire Cat AI via Custom Auth Handler

Cheshire Cat AI version 1.9.2 and earlier contains an authentication bypass vulnerability due to flawed logic in the _authorize_http_key function located in core/cat/factory/custom_auth_handler.py. An attacker can exploit this by manipulating the user_id argument to bypass authentication mechanisms entirely. The vulnerability allows remote, unauthenticated access to the application, potentially leading to unauthorized operations within the AI framework. As the vulnerability has been publicly disclosed and the project maintainers have not yet provided a patch, installations of Cheshire Cat AI are at risk of exploitation. Defenders should monitor web server access logs for anomalous requests to API endpoints that rely on the affected custom authentication handler.

Attack Chain

1. Attacker performs reconnaissance to identify instances of Cheshire Cat AI exposed to the internet.
2. Attacker locates the application endpoint that utilizes the core/cat/factory/custom_auth_handler.py authentication logic.
3. Attacker crafts an HTTP request targeting the affected function _authorize_http_key.
4. Attacker injects a manipulated user_id argument into the request parameters to bypass authentication checks.
5. The application fails to validate the identity of the requester, granting the attacker an authenticated session.
6. Attacker leverages the gained session to perform unauthorized API calls or interact with the AI logic.
7. Final objective is achieved, which may include data exfiltration or arbitrary command execution within the application context.

Impact

Successful exploitation allows a remote, unauthenticated attacker to bypass authentication controls, potentially gaining full control over the Cheshire Cat AI instance. This could lead to the exposure of sensitive AI models, processed data, and underlying system commands. The vulnerability affects all users running versions 1.9.2 and earlier, as there is currently no vendor-provided patch.

Recommendation

• Monitor web server logs for HTTP requests directed at authentication endpoints containing non-standard or unexpected user_id values.
• Implement strict network access controls to limit exposure of the Cheshire Cat AI interface to trusted networks only until a security update is released.
• Evaluate the necessity of the custom authentication handler and consider implementing external authentication proxies (e.g., OAuth2, OIDC) as an interim compensating control.