Executive brief
The Appwrite CLI is a command-line tool used by developers to manage Appwrite backend services. When users log in via the CLI, their credentials are stored in a configuration file with overly permissive file permissions (0644), allowing any local user on the same system to read and steal those credentials. This could lead to unauthorized access to Appwrite projects and data.
Technical details
The vulnerability is a hardcoded credential exposure issue (CWE-798) affecting Appwrite CLI versions before 3.0.0. When the login command is executed, user credentials are persisted to ~/.appwrite/prefs.json with UNIX file permissions 0644, making the file readable by all local users on a multi-user system. This is a local attack vector requiring only the ability to log into the system as a non-root user. An attacker can read the stored credentials and use them to authenticate to the Appwrite backend, gaining full access to the victim's projects. The vulnerability has been fixed in version 3.0.0 by implementing secure credential storage with restricted file permissions.
Affected products
- Appwrite CLI before 3.0.0
Timeline
- 2024-01-09: disclosed
- 2024-01-09: patched: Fixed in version 3.0.0