CVE-2021-41191
📋 TL;DR
CVE-2021-41191 is an authentication bypass vulnerability in Roblox-Purchasing-Hub that allows unauthorized access to product files without requiring an API key. Attackers who obtain someone's API URL can download product files they shouldn't have access to. This affects users running versions 1.0.1 and earlier of the Roblox-Purchasing-Hub software.
💻 Affected Systems
- Roblox-Purchasing-Hub
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized actors could download all product files, potentially exposing sensitive product data, intellectual property, or proprietary content without authentication.
Likely Case
Attackers who discover API URLs could download product files they shouldn't have access to, leading to data exposure and potential intellectual property theft.
If Mitigated
With proper API key authentication, only authorized users can access product files, maintaining proper access controls.
🎯 Exploit Status
Exploitation requires knowledge of the target's API URL but no authentication credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.2
Vendor Advisory: https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8q
Restart Required: Yes
Instructions:
1. Update to version 1.0.2 or later. 2. Restart the Roblox-Purchasing-Hub service. 3. Verify the fix by testing API access without authentication.
🔧 Temporary Workarounds
Manual API Key Requirement
allAdd @require_apikey decorator to the vulnerable route to enforce API key authentication
Edit BOT/lib/cogs/website.py and add @require_apikey above the route for /v1/products
🧯 If You Can't Patch
- Implement network-level access controls to restrict access to the API endpoints
- Monitor API access logs for unauthorized requests to /v1/products endpoint
🔍 How to Verify
Check if Vulnerable:
Attempt to access /v1/products endpoint without providing an API key. If successful, the system is vulnerable.Check Version:
Check the software version or review the commit history for version 1.0.1 or earlierVerify Fix Applied:
Attempt to access /v1/products endpoint without an API key. Access should be denied with proper authentication required.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /v1/products endpoint
- Successful product file downloads without API key authentication
Network Indicators:
- HTTP GET requests to /v1/products without authentication headers
- Unusual download patterns from product endpoints
SIEM Query:
source="web_logs" AND uri="/v1/products" AND NOT auth_token=*🔗 References
- https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03
- https://github.com/Redon-Tech/Roblox-Purchasing-Hub/releases/tag/V1.0.2
- https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8q
- https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03
- https://github.com/Redon-Tech/Roblox-Purchasing-Hub/releases/tag/V1.0.2
- https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8q
