Week 14 - Algolia API Keys
Algolia API Misconfiguration
Today’s week 14 tip is centered around Algolia API hacking. In doing some research this week, I came across this vulnerability which I was previously unaware of:
Algolia API’s are basic REST API’s that use an AppID and API Key to define a client. Both are meant to be public and are visible to any attacker using a proxy tool like Burp Suite. As an attacker, you can directly retrieve the permissions for an API key using the below link:
APPID-dsn.algolia-net/1/keys/APIKEY?x-algolia-application-id=APPID&x-algolia-api-key=APIKEY
After filling in your clients APPID and APIKEY, this link will spit out the key’s permissions in JSON. Often, the keys will be misconfigured. If they are setup correctly, they should only have the ‘search’ permission. MANY times, they have other permissions like:
listIndexes -> Get list of all existing indexes -> Information Disclosure
editSettings -> Update Index settings -> Allows for Stored XSS
addObject -> Add or update records -> Could be used for defacement
logs -> Query the logs -> Information disclosure
As you can see, the impact of misconfigured Algolia API keys can be huge. The ‘listIndexes’ permission often results in the disclosure of internal company data stored within an Algolia index. The ‘editSettings’ permission is the worst case, as it allows an attacker to specify a JavaScript payload that is executed every time a search is called.
Last updated