{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/eea/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@eeacms/volto-chatbot (2.0.3)"],"_cs_severities":["high"],"_cs_tags":["web-application","proxy","api-security"],"_cs_type":"advisory","_cs_vendors":["EEA"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@eeacms/volto-chatbot\u003c/code\u003e package contains a configuration issue in its Express middleware that exposes an unauthenticated proxy to the Danswer API. The vulnerability (CWE-862) resides in the \u003ccode\u003e/_v1_da/\u003c/code\u003e route, which forwards requests to the configured \u003ccode\u003eDANSWER_URL\u003c/code\u003e without performing authorization checks or path validation. When the add-on is configured with \u003ccode\u003eDANSWER_API_KEY\u003c/code\u003e or session cookies, the middleware silently attaches these credentials to requests. An unauthenticated attacker can control the destination path and HTTP method, effectively acting as the service account to perform unauthorized actions against the Danswer backend.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an instance of \u003ccode\u003e@eeacms/volto-chatbot\u003c/code\u003e accessible over the network.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted, unauthenticated HTTP request to the \u003ccode\u003e/_v1_da/\u003c/code\u003e endpoint on the Volto server.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eproxyMiddleware\u003c/code\u003e intercepts the request without requiring authentication or session validation.\u003c/li\u003e\n\u003cli\u003eThe middleware extracts the attacker-supplied path from the request URL.\u003c/li\u003e\n\u003cli\u003eThe middleware constructs an upstream URL by appending the attacker's path to the configured \u003ccode\u003eDANSWER_URL\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe middleware silently attaches the server-side \u003ccode\u003eDANSWER_API_KEY\u003c/code\u003e or session cookie to the outbound request headers.\u003c/li\u003e\n\u003cli\u003eThe middleware forwards the request to the Danswer API, which processes the action as a privileged command from the service account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform actions as the Danswer service account. Depending on the service account's permissions, this may lead to the unauthorized disclosure of sensitive documents and conversation history, or the mutation of system state, such as deleting users or creating chat sessions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@eeacms/volto-chatbot\u003c/code\u003e to a patched version once released by the maintainers.\u003c/li\u003e\n\u003cli\u003eIf a patch is unavailable, immediately restrict network access to the Volto server to trusted internal segments.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) rule to block all requests to the \u003ccode\u003e/_v1_da/\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eAudit Danswer API access logs for requests originating from the Volto server IP address with suspicious or administrative paths (e.g., \u003ccode\u003e/admin/\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T18:37:50Z","date_published":"2026-10-29T18:37:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-volto-chatbot-danswer-proxy/","summary":"An unauthenticated Express middleware vulnerability in @eeacms/volto-chatbot allows remote attackers to proxy requests to the Danswer API using the server’s own privileged service credentials.","title":"@eeacms/volto-chatbot: Unauthenticated Danswer API Confused Deputy Proxy","url":"https://feed.craftedsignal.io/briefs/2026-10-volto-chatbot-danswer-proxy/"}],"language":"en","title":"CraftedSignal Threat Feed - EEA","version":"https://jsonfeed.org/version/1.1"}