[IT-SecNots] [Security-news] AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-004

Project: AI (Artificial Intelligence) [1]
Date: 2025-January-22
Security risk: *Moderately critical* 14 ∕ 25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass, Information Disclosure

Affected versions: <1.0.3
Description: 
The AI logging sub-module enables you to log AI requests and responses for
debugging and auditing purposes.

The module doesn't sufficiently check for access to view the preview listing
of the logs. Full log details are correctly protected, and API keys are never
logged.

This vulnerability is mitigated by the fact that it only affects sites using
the AI Logging sub-module with 'Log requests' enabled in the AI Logging
configuration page.

Solution: 
Install the latest version:

  * If you use AI 1.x, upgrade to AI 1.0.3 [3].

An update hook will update the view to use the view ai log permission. If you
use version controlled configuration, remember to capture this.

(or) Disable the AI Logging module.

(or) Manually update the ai_logs view's access check to use the view ai log
permission.

Reported By: 
  * Mingsong  [4]

Fixed By: 
  * Scott Euser [5]
  * Marcus Johansson [6]
  * Andrew Belcher [7]

Coordinated By: 
  * Greg Knaddison [8] of the Drupal Security Team
  * Juraj Nemec [9] of the Drupal Security Team
  * Dave Long [10] of the Drupal Security Team


[1] https://www.drupal.org/project/ai
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ai/releases/1.0.3
[4] https://www.drupal.org/user/2986445
[5] https://www.drupal.org/user/3267594
[6] https://www.drupal.org/user/385947
[7] https://www.drupal.org/user/655282
[8] https://www.drupal.org/user/36762
[9] https://www.drupal.org/user/272316
[10] https://www.drupal.org/u/longwave

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news