Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC

An unauthenticated attacker sends a POST request to `/rest/v1/rpc/upsert_version_meta` using the public Supabase anon key (the `sb_publishable_*` key) with attacker-controlled `p_app_id`, `p_version_id`, and `p_size` JSON parameters. The function is granted to the `anon` role and is `SECURITY DEFINER`, so it bypasses row-level security on `version_meta` and inserts the data without any authorization checks [ref_id=1]. This enables cross-tenant writes to any victim application's storage metadata.

The vulnerability is in the Supabase PostgreSQL function `public.upsert_version_meta(p_app_id, p_version_id, p_size)` exposed as a PostgREST RPC endpoint. The function is defined as `SECURITY DEFINER` and is granted EXECUTE to the `anon` role ([ref_id=1]). It performs no authorization checks, allowing any caller to insert rows into `public.version_meta` for arbitrary `app_id` and `version_id` values without verifying ownership.

The advisory recommends removing the `EXECUTE` privilege on `public.upsert_version_meta` from the `anon` and `authenticated` roles, restricting it to `service_role` only. It also recommends adding explicit authorization inside the function: derive the caller's identity via `public.get_identity('{write,all}'::public.key_mode[])`, verify that the caller has rights to `p_app_id`, and confirm that `p_version_id` belongs to `p_app_id`. Additionally, the advisory suggests rejecting negative `p_size` values or enforcing strict bounds [ref_id=1]. The patch thus closes the privilege escalation path by removing public access and adding ownership checks.

The advisory includes a PoC that demonstrates the exploit [ref_id=1]. An attacker runs a shell script that calls `curl` against the RPC endpoint with the anon key and attacker-chosen `p_app_id`, `p_version_id`, and `p_size` values. The PoC shows the function returns `true` on the first insert (whether positive or negative size) and `false` on a duplicate insert, confirming arbitrary write capability for any app ID.