chroma-db-unauth: Chroma DB - Information Disclosure

id: chroma-db-unauth

info:
  name: Chroma DB - Information Disclosure
  author: Shay Ben Tikva
  severity: high
  description: |
    Chroma DB API endpoints were accessible and exposed collection metadata, enabling enumeration of collections under the default tenant and database, potentially leading to sensitive vector data disclosure.
  reference:
    - https://www.trychroma.com/security
    - https://github.com/shaybentk/chroma-db-unauthorized-info-disclosure
  metadata:
    max-request: 2
    verified: true
  tags: misconfig,api,info-leak,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/collections?tenant=default_tenant&database=default_database"
      - "{{BaseURL}}/api/v2/tenants/default_tenant/databases/default_database/collections"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"sync_threshold":'
          - '"log_position"'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100ef555aaaf727ca93029818a82ffca72eff257f485fcb2d16f6108242ce6d5b1102201b2ce158a585ae2006f3071512f78608675a5d0943d3994880a6dc20e098dad9:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.