CVE-2024-55963
📋 TL;DR
This vulnerability allows any authenticated user without admin permissions to trigger the restart API in Appsmith, causing a denial of service through repeated server restarts. It affects all Appsmith instances running versions before 1.51. The issue stems from improper access control checks that fail to verify super user permissions.
💻 Affected Systems
- Appsmith
📦 What is this software?
Appsmith by Appsmith
⚠️ Risk & Real-World Impact
Worst Case
An attacker could repeatedly restart the Appsmith server, causing sustained downtime and disrupting all Appsmith-based applications and workflows.
Likely Case
Malicious or accidental triggering of the restart API leads to intermittent service disruption and potential data loss for in-progress operations.
If Mitigated
With proper access controls, only authorized administrators can restart the server, eliminating the denial of service risk.
🎯 Exploit Status
Exploitation requires authenticated access but no special privileges. The API endpoint is documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.51 and later
Vendor Advisory: https://github.com/appsmithorg/appsmith/security/advisories/GHSA-6mc8-hw5c-7qqr
Restart Required: Yes
Instructions:
1. Update Appsmith to version 1.51 or later. 2. Restart the Appsmith service/container. 3. Verify the fix by testing restart API access with non-admin users.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the Appsmith restart API endpoint using firewall rules or network policies.
iptables -A INPUT -p tcp --dport <appsmith_port> -m string --string "api/v1/admin/restart" --algo bm -j DROP
Authentication Layer Protection
allImplement additional authentication/authorization layer (like reverse proxy with strict ACL) in front of Appsmith.
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to Appsmith only to trusted users.
- Monitor and alert on frequent restart API calls from non-admin users.
🔍 How to Verify
Check if Vulnerable:
Check Appsmith version: if version < 1.51, system is vulnerable. Test by attempting to call the restart API with a non-admin authenticated user.Check Version:
docker exec <appsmith_container> cat /opt/appsmith/rts/version.json | grep versionVerify Fix Applied:
After updating to 1.51+, attempt to call the restart API with a non-admin user - it should return a 403 Forbidden error.📡 Detection & Monitoring
Log Indicators:
- Multiple 'POST /api/v1/admin/restart' requests from non-admin users
- Frequent server restart events in Appsmith logs
Network Indicators:
- Unusual frequency of POST requests to /api/v1/admin/restart endpoint
SIEM Query:
source="appsmith" AND "POST /api/v1/admin/restart" AND user_role!="admin"