Adam Nurudini

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An issue exists in the `searchQueryBuilder()` function of `UtmAssetGroupService` where authenticated attackers can inject arbitrary SQL. This occurs because the `assetType` and `groupName` variables are inserted unsanitized into a native PostgreSQL query using `String.format()`. Exploitation of the GET '/api/utm-asset-groups/searchGroupsByFilter' endpoint allows the execution of arbitrary SQL with DBA privileges, which can lead to full database read, data modification, and potential filesystem access. **Recommendations** Update UTMStack to version 11.2.16 or later. Avoid using the `assetType` and `groupName` variables in the '/api/utm-asset-groups/searchGroupsByFilter' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An authenticated attacker can trigger a server-side request forgery (SSRF) by providing a malicious metadata URL to the `POST/PUT /api/identity-providers` endpoint. This occurs because the `IdentityProviderService.validateMetadataUrl()` function fails to validate the target host, IP, or scheme. This flaw allows the server to send requests to arbitrary internal or cloud metadata hosts, enabling internal network port scanning and unauthorized access to cloud instance-metadata services. **Recommendations** Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the `/api/identity-providers` endpoint.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An authorization flaw exists in the `UTMIncidentCommandWebsocket.processCommand()` function, which handles the '/command/{hostname}' STOMP destination. The system fails to perform role checks or apply a command allowlist before forwarding instructions. Consequently, any authenticated user can send arbitrary operating-system commands via gRPC to any connected agent, leading to command execution on monitored endpoints where agent processes typically operate with root or SYSTEM privileges. **Recommendations** Update to version 11.2.16. Rotate the `INTERNAL KEY`.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An authentication bypass exists that allows remote attackers to obtain full administrative API access. This occurs because the `InternalApiKeyFilter` accepts a valid `Utm-Internal-Key` header matching the `INTERNAL KEY` environment variable for any endpoint. The implementation lacks path restrictions, constant-time comparison, rate limiting, and audit logging. Attackers possessing this key can bypass user account requirements or JSON Web Tokens (JWT) to create accounts, manage users, exfiltrate data, and modify security rules. **Recommendations** Update UTMStack to version 11.2.16 or later.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An account enumeration issue exists that allows unauthenticated attackers to identify registered email addresses. By sending requests to the 'POST /api/account/reset-password/init' endpoint, attackers can distinguish between registered and unregistered accounts based on the HTTP response. Registered accounts return a 200 OK response, while unregistered accounts trigger a 500 Internal Server Error containing backend details. This information can be used to facilitate targeted phishing or credential attacks. **Recommendations** Update to version 11.2.16 or later.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** Authenticated attackers can perform a server-side request forgery (SSRF), a flaw where the server is tricked into making requests to an unintended location. By providing an unvalidated `url` parameter to the `downloadPdf()` function within the `PdfService`, exposed via the GET '/api/generate-pdf-report' endpoint, attackers can force the web-pdf microservice to access internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service. This allows sensitive internal data to be retrieved and rendered into the resulting PDF file. **Recommendations** Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the '/api/generate-pdf-report' endpoint or avoid using the `url` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** Authenticated attackers can read arbitrary entity data by exploiting a JPQL injection issue. The vulnerability exists in the `UtmNetworkScanService.searchPropertyValues()` function, which constructs a JPQL query using `String.format()` and executes it via `em.createQuery()` without proper parameter binding. By sending malicious JPQL through the `value` parameter in the 'GET /api/utm-network-scans/searchPropertyValues' endpoint, attackers can extract sensitive information, including credential tables such as `jhi user`. JPQL (Java Persistence Query Language) is an object-oriented query language used to perform database operations on entities. **Recommendations** Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the 'GET /api/utm-network-scans/searchPropertyValues' endpoint or avoid using the `value` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ClipBucket versions prior to 5.5.3-#182 **Description** Authenticated users can extract arbitrary data from the database via a blind SQL injection. This occurs when the `check photo` parameter is submitted as an array, bypassing the `clean requests()` sanitization function in ClipBucket.class.php. Unsanitized array elements are passed through the bulk deletion handler in the 'manage photos.php' endpoint to the `photo exists()` function in photos.class.php, where non-numeric values are interpolated directly into a SQL query. This allows for time-based blind SQL injection, a technique that infers data by observing the time the server takes to respond to specific queries, to retrieve credential hashes and other sensitive information. **Recommendations** Update to version 5.5.3-#182 or later. Avoid submitting the `check photo` parameter as an array in the 'manage photos.php' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ClipBucket versions prior to 5.5.3-#182 **Description** Authenticated users can extract arbitrary database contents, including user credential hashes and email addresses, through a time-based blind SQL injection. This occurs when the `msg id` parameter is submitted as an array to bypass the `clean requests()` sanitization function in ClipBucket.class.php. The unsanitized array elements are passed through the deletion handler in 'private message.php' into the `cb pm::delete msg()` function, which interpolates the unescaped message ID directly into a SQL query string. **Recommendations** Update ClipBucket to version 5.5.3-#182 or later. As a temporary mitigation, restrict access to the 'private message.php' handler or avoid using the `msg id` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ClipBucket versions prior to 5.5.3-#182 **Description** Authenticated users can achieve remote code execution by uploading a PHP file containing valid image magic bytes through the photo upload endpoint. The `FileUpload::manageFile()` function in `fileupload.class.php` fails to update the file extension after MIME validation. This allows a `.php` extension controlled by the attacker to remain on the disk and execute as PHP via PHP-FPM when the file is retrieved. **Recommendations** Update to version 5.5.3-#182 or later. As a temporary mitigation, restrict access to the photo upload endpoint or disable the `FileUpload::manageFile()` function until the update is applied.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** ClipBucket V5 (لم يتم تحديد الإصدارات المتأثرة) **الوصف** يفشل برنامج التثبيت عبر الويب في التحقق من صحة المعلمة `php cli filepath` أو تصفية قيمتها بشكل صحيح قبل تمريرها إلى تنفيذ shell. وهذا يسمح للمهاجمين غير المصادق عليهم بإرسال طلب POST مُصمم خصيصًا إلى برنامج التثبيت مع قيمة ضارة في المتغير `php cli filepath` لتنفيذ أوامر عشوائية بصفتهم مستخدم خادم الويب. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات rConfig الأقدم من 8.2.13 **الوصف** يمكن للمستخدمين المصادق عليهم قراءة ملفات عشوائية عن طريق تزويد نقطة نهاية تنزيل التصدير بأسماء ملفات مصممة خصيصًا تحتوي على تسلسلات لاجتياز الدلائل. ومن خلال التلاعب بالمعلمة `filename`، يمكن للمهاجم تجاوز دليل التصدير المقصود والوصول إلى الملفات الموجودة خارجه والتي يمكن لعملية التطبيق قراءتها. تعد تقنية تجاوز المسار (path traversal) تقنية تُستخدم للوصول إلى الملفات والدلائل المخزنة خارج المجلد الجذر للويب. **التوصيات** قم بالتحديث إلى الإصدار 8.2.13 أو أحدث. تجنب استخدام المعلمة `filename` في نقطة نهاية تنزيل التصدير حتى يتم تطبيق التحديث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات rConfig من 8.0.0 إلى 8.2.12 **الوصف** توجد ثغرة تسمح بتجاوز المصادقة بسبب تكرار استدعاء `Auth::routes()` في ملف `routes/web.php`، مما يؤدي عن غير قصد إلى إعادة تمكين نقطة النهاية `POST /register` بعد أن تم تعطيلها. وهذا يسمح للمهاجمين غير المصادق عليهم بتسجيل حسابات بأنفسهم. ونظرًا لأن وحدة التحكم في التسجيل لا تخصص دورًا محددًا، ويكون العمود `users.role` افتراضيًا هو «Admin»، فإن الحسابات التي تم إنشاؤها حديثًا تُمنح امتيازات المسؤول الكاملة. وقد يؤدي ذلك إلى الوصول غير المصرح به إلى بيانات اعتماد الأجهزة المخزنة وبيانات المستخدمين وإصدار رموز API. **التوصيات** قم بتحديث rConfig إلى الإصدار 8.2.13 أو أحدث. كإجراء تخفيفي مؤقت، قم بتقييد الوصول إلى نقطة النهاية `POST /register`.