Vulnerability in vastxie 99AI

[ Description ]Official description

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/vastxie/99AI
• github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.controller.ts
• github.com/vastxie/99AI/blob/v4.3.0/service/src/modules/chatLog/chatLog.service.ts
• hackmd.io/@hieuPenguinnn/99ai-chatlog-unauth-export-and-idor
• www.vulncheck.com/advisories/99ai-through-4.3.0-unauthenticated-information-disclosure-…