Tandoor Recipes - CraftedSignal Threat Feed

Tandoor Recipes Host Header Injection Vulnerability (CVE-2026-33149)

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

Tandoor Recipes, a recipe management and meal planning application, is vulnerable to a host header injection (CVE-2026-33149) in versions up to and including 2.5.3. The vulnerability stems from the application setting ALLOWED_HOSTS = '*' by default, which disables Host header validation in the Django framework. This lack of validation allows attackers to craft malicious HTTP requests with arbitrary Host headers. The application uses request.build_absolute_uri() to generate absolute URLs in various contexts, including invite link emails, API pagination, and OpenAPI schema generation. This vulnerability allows an attacker to manipulate these generated URLs. The most significant risk is invite link poisoning, where an attacker can make invite links in emails redirect to an attacker-controlled server, potentially compromising user accounts. No patched version is available as of the source publication date.

Attack Chain

An attacker identifies a Tandoor Recipes instance running a vulnerable version (<= 2.5.3).
The attacker crafts an HTTP request to the Tandoor Recipes instance with a malicious Host header (e.g., Host: attacker.com).
An administrator of the Tandoor Recipes instance generates an invitation link for a new user.
The application uses request.build_absolute_uri() to construct the invitation link, incorporating the attacker-controlled Host header.
The invitation email is sent to the intended user, containing the malicious invitation link pointing to attacker.com.
The user clicks the malicious link in the email, unknowingly sending the invite token to the attacker's server.
The attacker uses the stolen invite token to create an account on the legitimate Tandoor Recipes instance.
The attacker gains unauthorized access to the Tandoor Recipes instance, potentially escalating privileges depending on the application's configuration and the compromised user's role.

Impact

Successful exploitation of this vulnerability can lead to invite link poisoning, allowing attackers to create unauthorized accounts on the Tandoor Recipes instance. The number of potential victims is directly proportional to the number of Tandoor Recipes instances deployed with the vulnerable configuration and the number of users invited through the application. The impact includes unauthorized access to user data, potential modification or deletion of recipes, and the possibility of further lateral movement within the affected environment if the compromised account has elevated privileges. The CVSS v3.1 base score for this vulnerability is 8.1, indicating a high severity.

Recommendation

Monitor web server logs for suspicious HTTP requests with unusual or unexpected Host headers to detect potential exploitation attempts. Analyze webserver logs for abnormalities in cs-uri-query for invite URLs (related to invite link poisoning).
Implement a web application firewall (WAF) rule to validate the Host header against a whitelist of expected values.
Apply available patches as soon as they are released for Tandoor Recipes to remediate CVE-2026-33149.

Tandoor Recipes Authentication Bypass Vulnerability (CVE-2026-35045)

hello@craftedsignal.io — Sat, 27 Jan 2024 12:00:00 +0000

Tandoor Recipes, an application for managing recipes, planning meals, and building shopping lists, contains an authentication bypass vulnerability. Specifically, versions prior to 2.6.4 are susceptible to CVE-2026-35045. This flaw enables any authenticated user within a shared Space to modify any recipe within that Space, regardless of the recipe's privacy settings. The vulnerability stems from a lack of object-level authorization checks on the /api/recipe/batch_update/ endpoint, contrasting with the more restrictive single-recipe endpoints (PUT /api/recipe/{id}/). This allows attackers to force the exposure of private recipes, grant themselves unauthorized access, and tamper with recipe metadata. Defenders should prioritize upgrading Tandoor Recipes to version 2.6.4 to remediate this vulnerability.

Attack Chain

An attacker authenticates to a Tandoor Recipes instance.
The attacker identifies a Space containing recipes they wish to modify, including private recipes.
The attacker crafts a PUT request to the /api/recipe/batch_update/ endpoint.
The request includes a payload designed to modify the target recipe (e.g., changing the recipe name, ingredients, or privacy settings).
The application, lacking proper authorization checks on this endpoint, processes the request.
The target recipe is modified according to the attacker's specifications, bypassing intended privacy restrictions.
The attacker can then exfiltrate or further manipulate the recipe data.

Impact

Successful exploitation of CVE-2026-35045 can lead to the unauthorized disclosure of private recipes, potentially containing sensitive personal information or proprietary culinary techniques. It can also facilitate the tampering of recipe data, leading to incorrect or malicious instructions. This vulnerability affects all Tandoor Recipes instances running versions prior to 2.6.4 and accessible to authenticated users.

Recommendation

Upgrade Tandoor Recipes to version 2.6.4 or later to patch CVE-2026-35045.
Implement the Sigma rule Detect Tandoor Recipe Batch Update to monitor for suspicious requests to the /api/recipe/batch_update/ endpoint.
Review webserver access logs for unusual PUT requests targeting the /api/recipe/batch_update/ endpoint after authentication, to identify possible exploitation attempts.

Tandoor Recipes Unauthenticated Password Guessing Vulnerability (CVE-2026-33152)

hello@craftedsignal.io — Tue, 09 Jan 2024 15:00:00 +0000

Tandoor Recipes, a recipe management and meal planning application, is susceptible to a critical vulnerability (CVE-2026-33152) in versions prior to 2.6.0. The application's configuration of Django REST Framework with BasicAuthentication as a default authentication backend, combined with insufficient rate limiting, creates a significant security risk. The AllAuth rate limiting (ACCOUNT_RATE_LIMITS: login: 5/m/ip) is only applied to the HTML login endpoint (/accounts/login/), leaving API endpoints unprotected. This allows attackers to bypass rate limiting and account lockout mechanisms by sending authentication requests directly to the API. This vulnerability enables an attacker to perform unlimited password attempts against valid usernames, potentially gaining unauthorized access to user accounts and sensitive data. Tandoor Recipes version 2.6.0 addresses this vulnerability.

Attack Chain

The attacker identifies a Tandoor Recipes instance running a version prior to 2.6.0.
The attacker discovers valid usernames through OSINT techniques or by leveraging other vulnerabilities (not described in source).
The attacker crafts HTTP requests with Authorization: Basic headers targeting an API endpoint that accepts authenticated requests.
The attacker sends multiple requests with different password guesses using a scripting language like Python and the requests library.
The Tandoor Recipes server authenticates the request if the credentials match a valid user.
If successful, the attacker gains access to the targeted user's account.
The attacker accesses, modifies, or exfiltrates recipes, meal plans, shopping lists, and potentially other user data.
The attacker pivots to other user accounts if sufficient privileges exist, further expanding their access and potential damage.

Impact

Successful exploitation of CVE-2026-33152 allows attackers to compromise user accounts on vulnerable Tandoor Recipes instances. This can lead to unauthorized access to sensitive user data, including personal recipes, meal plans, and shopping lists. Depending on the application's deployment and user permissions, attackers may also be able to modify data, add malicious content, or pivot to other systems. The lack of rate limiting makes password guessing attacks highly effective, increasing the risk of widespread account compromise.

Recommendation

Upgrade Tandoor Recipes instances to version 2.6.0 or later to patch CVE-2026-33152.
Implement rate limiting on API endpoints that accept BasicAuthentication, independent of AllAuth's HTML login rate limiting.
Deploy the Sigma rule Detect Tandoor Recipes Basic Authentication Brute Force to identify potential password guessing attempts against Tandoor Recipes instances in your environment.
Monitor web server logs for excessive Authorization: Basic header usage targeting Tandoor Recipes API endpoints.