Summary
AiSOC versions before 12.0.0 contain an authorization bypass in the MSSP module that lets authenticated users add arbitrary tenant UUIDs to portfolios they own. This may allow users to claim unassigned tenants and access their security alerts, incidents, and posture metrics without authorization.
Affected context
The issue occurs in AiSOC deployments using the MSSP module when the
add_tenants_to_portfolio endpoint accepts tenant UUIDs without adequately
verifying that the requesting user is authorized to manage each tenant.
The risk is greatest where tenant identifiers can be obtained or guessed and
unclaimed tenants are eligible to be added to user-controlled portfolios.
Exploit preconditions
- Attack surface: The MSSP portfolio-management API
- Required access: A valid authenticated AiSOC user account with permission to manage a portfolio
- Trigger point: Submission of tenant UUIDs to the
add_tenants_to_portfolioendpoint - Authorization condition: The target tenant is unclaimed or otherwise not associated with the requesting user's authorized tenant scope
- Why exploitation is possible: Server-side authorization checks may validate portfolio ownership without confirming authorization over every tenant being added
Why this happens
The underlying bug is an object-level authorization failure mapped to
CWE-639: Authorization Bypass Through User-Controlled Key. The endpoint
trusts a user-supplied tenant identifier and does not consistently enforce
ownership or membership authorization for the referenced tenant. As a result,
controlling a portfolio can be incorrectly treated as sufficient authority to
access unrelated tenant resources.
Potential impact
- Users may gain unauthorized access to tenant security alerts
- Incident information may be exposed across tenant boundaries
- Posture metrics may be disclosed without tenant consent
- Unclaimed tenants may be improperly associated with an attacker-controlled portfolio
- Confidentiality and trust between managed-service tenants could be weakened
General mitigation guidance
Mitigation generally focuses on enforcing object-level authorization for every
tenant reference, rather than relying only on portfolio ownership.
Common defensive patterns include:
- Verifying that the caller is authorized for each tenant UUID on the server side
- Rejecting tenant identifiers outside the caller's explicit tenant scope
- Applying deny-by-default authorization policies to portfolio and tenant operations
- Avoiding authorization decisions based solely on user-controlled identifiers
- Limiting the data returned after portfolio changes to the caller's authorized scope
- Using least-privilege roles and clear tenant-isolation boundaries
- Recording and reviewing tenant-association changes for unusual access patterns
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for API handlers that trust object IDs from requests
- Verification that every referenced tenant undergoes an explicit authorization check
- Integration tests covering cross-tenant, unclaimed-tenant, and unauthorized-object scenarios
- API policy enforcement requiring object-level access decisions before state changes
- Audit-log monitoring for unexpected tenant additions or access to newly associated tenants
- Automated security testing that substitutes identifiers belonging to other tenants
