GHSA-pp95-gc86-jq6q: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
The run replay action function at apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts has no authentication or authorization check. While the loader (GET) in the same file properly calls requireUser(request) and scopes queries to the user’s organizations, the action (POST) at line 166 does neither — allowing any authenticated user to replay task runs from any organization by knowing the run’s friendlyId.
References
- github.com/advisories/GHSA-pp95-gc86-jq6q
- github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
- github.com/triggerdotdev/trigger.dev/pull/4199
- github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
- github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
Code Behaviors & Features
Detect and mitigate GHSA-pp95-gc86-jq6q with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →