A search box that JOINed to your token table: ORM filter injection in KoboToolbox (GHSA-xrq7-925g-qg5m)

KoboToolbox, an open-source data collection platform for humanitarian action, development, environmental protection, research, and social good, discovered a vulnerability in its kpi server called ORM filter injection. This flaw, identified as GHSA-xrq7-925g-qg5m, allows authenticated users to recover parts of an owner's API token through a malicious search query. The search box in the asset table of the kpi inadvertently allowed users to construct a Django Q(**{field: value}) object, granting access to unintended fields.

When a GET request is made to the search endpoint with a specially crafted query, the permission filter allows the user to see assets shared with them. The KpiObjectPermissionsFilter then applies the user-defined query to a permission-scoped queryset. By inserting a lookup such as owner__auth_token__key__startswith, the attacker could retrieve individual characters of the owner's API token, one at a time. Although the loop was not executed further and no token was used, the vulnerability posed a significant security risk.

KoboToolbox addressed the issue in version 2.026.23a and notified self-hosted installations to update promptly. The vulnerability highlights the importance of securely implementing ORM filters in web applications, especially when sharing features are involved, to prevent unauthorized access to sensitive data.