The dfir-iris iris-web platform before version 2.4.28 exposes a GraphQL endpoint that lacks proper authorization enforcement. Authenticated users can exploit this endpoint to perform unauthorized read operations on Indicators of Compromise (IOCs) linked to arbitrary cases (IDOR), retrieve bulk IOC data, and create cases without proper permissions. The root cause is that the GraphQL resolvers, specifically the case.iocs resolver, do not verify whether the caller has access rights to the requested case data. The vulnerability was addressed by removing the GraphQL blueprint and related dependencies in version 2.4.28, effectively eliminating the vulnerable endpoint. As a temporary mitigation, blocking the /graphql endpoint at the reverse proxy or disabling the GraphQL blueprint in the application code is recommended.

An authenticated user can bypass intended access controls to read sensitive IOC data from cases they are not authorized to access, potentially exposing confidential investigation details. They can also create unauthorized cases, which may affect the integrity of the incident response process. This unauthorized data disclosure and manipulation can undermine the confidentiality and integrity of incident investigations.

A fix is available in dfir-iris iris-web version 2.4.28, which removes the vulnerable GraphQL endpoint entirely. Users should upgrade to version 2.4.28 to fully remediate the issue. As a workaround prior to upgrading, block the /graphql endpoint at the reverse proxy or disable the GraphQL blueprint by commenting out the relevant import and registration calls in source/app/views.py and restarting the application.