Astron Agent
Monthly
Authenticated low-privilege tenant users of iFlytek Astron Agent prior to 1.1.2 can run arbitrary Python as root inside the core-workflow container by submitting a workflow Code node, because the shipped default configuration routes dynamic code execution to an unsandboxed LocalExecutor that exposes the full set of Python builtins. From that foothold the attacker can read shared service and database credentials and use them to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services (CVSS 9.9, scope-changed, CWE-95). Exploitation requires a valid tenant account plus the ability to create or run a workflow containing a Code node; no public exploit identified at time of analysis, and the vendor-released patch is version 1.1.2.
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workflow identifiers and access workflows owned by other tenants via the copyFlow endpoint, which performs no ownership validation. Attackers can both exfiltrate private workflow definitions - exposing proprietary AI automation logic - and overwrite other tenants' production workflows, achieving high confidentiality and integrity impact across tenant boundaries. No active exploitation is confirmed by CISA KEV and no EPSS data was available, but the vulnerability is publicly disclosed via a GitHub issue and a VulnCheck advisory, making the technical details openly accessible to potential attackers.
Cross-tenant workflow hijacking in iFlytek Astron Agent through 1.1.2 lets an authenticated application on a shared deployment inject content into another tenant's paused workflow and read its continuation output stream by supplying the victim's event_id to POST /workflow/v1/resume. Exploitation requires a valid authenticated application identity (PR:L in the assessed vector) plus a victim workflow that is currently paused awaiting resume; the enabling weakness is that event_id values are time-ordered Snowflake identifiers that are predictable rather than cryptographically random. Severity is genuinely low (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), there is no CISA KEV entry, no public exploit identified at time of analysis, and the cross-tenant impact disappears entirely on single-tenant or otherwise isolated deployments.
Server-side request forgery (SSRF) in iFlytek astron-agent through version 1.0.6 lets an authenticated console user steer server-side HTTP requests to internal or otherwise restricted destinations by supplying a crafted endPoint argument to the debugToolV2 API, which reaches UrlCheckTool.checkUrl. The weakness is a redirect-handling gap: the pre-patch validator followed only a single 301/302/303 hop and ignored 307/308, so a URL that passes the initial blacklist/whitelist check can still bounce the request to an internal target; the vendor fixed this in release reward-1575 with a bounded 5-hop chain that revalidates every hop and detects loops. Impact is limited (CVSS 4.0 score 5.3; independent assessment CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requiring valid console credentials, and no public exploit identified at time of analysis.
SQL injection in the console component of iFlytek astron-agent (versions up to and including 1.0.7) lets an authenticated low-privilege user inject arbitrary SQL via the `sortDirection` parameter of the getBotList API, which is concatenated directly into the ORDER BY clause of ChatBotMarketMapper.xml. Because the vulnerable ORDER BY sink cannot return query results to the caller, exploitation is blind (time- or boolean-based), so an attacker with a valid console account and network access to the endpoint could progressively extract backend data - the independent assessment rates confidentiality impact as high (CVSS:3.1 C:H, PR:L, AV:N) with no integrity or availability effect. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS data was not supplied; the vendor addressed it in release reward-1575 by whitelisting the sort direction.
Authenticated low-privilege tenant users of iFlytek Astron Agent prior to 1.1.2 can run arbitrary Python as root inside the core-workflow container by submitting a workflow Code node, because the shipped default configuration routes dynamic code execution to an unsandboxed LocalExecutor that exposes the full set of Python builtins. From that foothold the attacker can read shared service and database credentials and use them to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services (CVSS 9.9, scope-changed, CWE-95). Exploitation requires a valid tenant account plus the ability to create or run a workflow containing a Code node; no public exploit identified at time of analysis, and the vendor-released patch is version 1.1.2.
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workflow identifiers and access workflows owned by other tenants via the copyFlow endpoint, which performs no ownership validation. Attackers can both exfiltrate private workflow definitions - exposing proprietary AI automation logic - and overwrite other tenants' production workflows, achieving high confidentiality and integrity impact across tenant boundaries. No active exploitation is confirmed by CISA KEV and no EPSS data was available, but the vulnerability is publicly disclosed via a GitHub issue and a VulnCheck advisory, making the technical details openly accessible to potential attackers.
Cross-tenant workflow hijacking in iFlytek Astron Agent through 1.1.2 lets an authenticated application on a shared deployment inject content into another tenant's paused workflow and read its continuation output stream by supplying the victim's event_id to POST /workflow/v1/resume. Exploitation requires a valid authenticated application identity (PR:L in the assessed vector) plus a victim workflow that is currently paused awaiting resume; the enabling weakness is that event_id values are time-ordered Snowflake identifiers that are predictable rather than cryptographically random. Severity is genuinely low (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), there is no CISA KEV entry, no public exploit identified at time of analysis, and the cross-tenant impact disappears entirely on single-tenant or otherwise isolated deployments.
Server-side request forgery (SSRF) in iFlytek astron-agent through version 1.0.6 lets an authenticated console user steer server-side HTTP requests to internal or otherwise restricted destinations by supplying a crafted endPoint argument to the debugToolV2 API, which reaches UrlCheckTool.checkUrl. The weakness is a redirect-handling gap: the pre-patch validator followed only a single 301/302/303 hop and ignored 307/308, so a URL that passes the initial blacklist/whitelist check can still bounce the request to an internal target; the vendor fixed this in release reward-1575 with a bounded 5-hop chain that revalidates every hop and detects loops. Impact is limited (CVSS 4.0 score 5.3; independent assessment CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), requiring valid console credentials, and no public exploit identified at time of analysis.
SQL injection in the console component of iFlytek astron-agent (versions up to and including 1.0.7) lets an authenticated low-privilege user inject arbitrary SQL via the `sortDirection` parameter of the getBotList API, which is concatenated directly into the ORDER BY clause of ChatBotMarketMapper.xml. Because the vulnerable ORDER BY sink cannot return query results to the caller, exploitation is blind (time- or boolean-based), so an attacker with a valid console account and network access to the endpoint could progressively extract backend data - the independent assessment rates confidentiality impact as high (CVSS:3.1 C:H, PR:L, AV:N) with no integrity or availability effect. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS data was not supplied; the vendor addressed it in release reward-1575 by whitelisting the sort direction.