CVE-2024-8954

The Composio application API accepts any arbitrary random value in the HTTP `x-api-key` header as a valid authentication key — without any verification of its correctness. An attacker sends a request to the API with the `x-api-key` header containing a random value, and the server treats such a request as authenticated. As a result, the authentication mechanism is completely ineffective and does not constitute any barrier to unauthorized access.

Attacker gains unauthorized access to the server with full privileges, which may lead to disclosure, modification, or destruction of processed data (high impact on confidentiality, integrity, and availability).

Apply patches available from the vendor according to references. Immediate update to version higher than 0.5.10 is recommended, and temporary restriction of access to Composio API at the network level (firewall, ACL lists) until the fix is deployed.

Composio (composiohq/composio) version 0.5.10