AVID-2026-R1612
Description
CSRF in danswer-ai/danswer (CVE-2024-8065)
Details
A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim’s browser. This includes connecting the victim’s application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.
Reason for inclusion in AVID: The AVID candidate describes a CVE-2024-8065 CSRF vulnerability in danswer-ai/danswer, an AI-oriented software component. This vulnerability is in software used to build/deploy AI systems (web/app layer of an AI assistant framework), representing a software supply-chain issue within AI stacks. It is a genuine security vulnerability (CSRF leading to unauthorized actions). The report provides sufficient evidence (CVSS, description, references) to assess risk.
References
Affected or Relevant Artifacts
- Developer: danswer-ai
- Deployer: danswer-ai
- Artifact Details:
| Type | Name |
|---|---|
| System | danswer-ai/danswer |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.0 |
| Vector String | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
| Base Score | 8.1 |
| Base Severity | 🔴 High |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | 🔴 High |
| Availability Impact | 🔴 High |
CWE
| ID | Description |
|---|---|
| CWE-352 | CWE-352 Cross-Site Request Forgery (CSRF) |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2025-03-20
- Version: 0.3.3
- AVID Entry