CVE-2024-8065: Danswer AI CSRF Vulnerability

CVE-2024-8065 Overview

CVE-2024-8065 is a Cross-Site Request Forgery (CSRF) vulnerability affecting danswer-ai/danswer version v1.4.1. The application lacks CSRF protection across state-changing endpoints. Attackers can trick authenticated users into executing unauthorized actions in the context of their browser session. Exploitable actions include connecting the victim's application to an attacker-controlled Slack Bot, inviting arbitrary users, and deleting chats. The weakness maps to [CWE-352] Cross-Site Request Forgery.

Critical Impact
Attackers can hijack authenticated sessions to modify integrations, escalate access through user invitations, and destroy chat data without the victim's knowledge.

Affected Products

danswer-ai/danswer version v1.4.1
Prior versions without CSRF token enforcement
Deployments exposing the danswer web interface to authenticated users

Discovery Timeline

2025-03-20 - CVE-2024-8065 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8065

Vulnerability Analysis

The danswer application processes authenticated state-changing requests without validating request origin. Sensitive endpoints accept cross-origin requests that carry the victim's session cookie. An attacker hosts a malicious page that submits forged requests to the danswer backend. The victim's browser attaches session credentials automatically, and the server executes the requested action.

Because the application implements no anti-CSRF tokens, no SameSite cookie enforcement, and no Origin or Referer header validation, any authenticated user who visits an attacker-controlled page becomes a vector. The impact scope covers integration configuration, user management, and data deletion.

Root Cause

The root cause is missing CSRF protection on POST, PUT, and DELETE endpoints in the danswer API. Session authentication relies solely on browser-managed cookies. The framework does not require a synchronizer token or double-submit cookie for state-changing operations, allowing arbitrary origins to trigger authenticated actions.

Attack Vector

Exploitation requires user interaction. The victim must visit an attacker-controlled web page while authenticated to a vulnerable danswer instance. The malicious page issues forged HTTP requests using auto-submitting forms or fetch calls with credentials: 'include'. The attacker can:

Bind the victim's danswer workspace to a malicious Slack Bot for data exfiltration.
Invite attacker-controlled accounts, expanding access to the workspace.
Delete chats to destroy audit trails or disrupt operations.

Technical details are documented in the Huntr Bounty Report.

Detection Methods for CVE-2024-8065

Indicators of Compromise

Unexpected Slack Bot integrations added to danswer workspaces without administrator approval.
Unrecognized user invitations sent from privileged accounts.
Sudden deletion of chat histories with no corresponding user action in local logs.
Web server logs showing state-changing requests with Referer or Origin headers pointing to external domains.

Detection Strategies

Inspect reverse proxy and application access logs for POST, PUT, or DELETE requests with cross-origin Referer or Origin values targeting danswer API paths.
Correlate configuration changes (Slack Bot connections, invitations, deletions) with the user session timeline to identify actions inconsistent with user activity.
Alert on integration modifications performed within seconds of a user loading an external, non-danswer domain.

Monitoring Recommendations

Enable audit logging for all administrative and integration endpoints in danswer.
Forward danswer application logs to a centralized SIEM and build detections for anomalous invitation and integration events.
Monitor Slack workspace app_installed and bot_added events for correlation with danswer administrative activity.

How to Mitigate CVE-2024-8065

Immediate Actions Required

Upgrade danswer to a version later than v1.4.1 that implements CSRF protection, once available from the maintainers.
Audit existing Slack Bot integrations, user invitations, and deleted chats for unauthorized activity.
Restrict access to the danswer web interface using network controls or SSO enforcement to limit exposure.

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Review the Huntr Bounty Report and the upstream danswer-ai/danswer repository for remediation status and updated releases.

Workarounds

Configure session cookies with SameSite=Strict or SameSite=Lax at the reverse proxy to block cross-site request inclusion of credentials.
Enforce Origin and Referer header validation at a reverse proxy such as NGINX or an API gateway for all state-changing endpoints.
Require administrators to use a dedicated browser profile for danswer to reduce the chance of visiting attacker-controlled pages in the same session.
Disable or restrict the Slack integration endpoints until CSRF protection is verified in the deployed version.

bash

# Example NGINX snippet enforcing Origin validation for state-changing methods
map $request_method $csrf_check {
    default 0;
    POST    1;
    PUT     1;
    PATCH   1;
    DELETE  1;
}

server {
    location /api/ {
        if ($csrf_check = 1) {
            set $bad_origin 1;
            if ($http_origin ~* "^https://danswer\.example\.com$") {
                set $bad_origin 0;
            }
            if ($bad_origin = 1) {
                return 403;
            }
        }
        proxy_pass http://danswer_backend;
    }
}