Bytejmp

توجد حالة سباق (race condition) في ملف `oauth-token.service.ts`. تحدث هذه المشكلة أثناء التدوير غير الذري (non-atomic rotation)، مما يسمح للمهاجم الذي استولى على رمز تحديث (refresh token) بتقديمه بالتزامن مع العميل الشرعي. ومن خلال القيام بذلك، يمكن للمهاجم الحصول على رموز وصول وتحديث خاصة به، مما يحافظ على وصول محدد النطاق إلى النظام دون تفعيل آلية اكتشاف إعادة الاستخدام.

توجد ثغرة كشف معلومات تسمح للمهاجمين غير المصرح لهم باسترداد سجلات عملاء OAuth كاملة. يتم ذلك من خلال الاستعلام عن مسار البحث العام عن العملاء في `oauth.controller.ts`. يمكن للمهاجمين الذين يعرفون أو يخمنون معرف العميل الحصول على رمز الوصول للتسجيل، وهاش سر العميل bcrypt، والمعرف الداخلي للمالك، مما قد يسمح لهم بتعديل التسجيلات أو حذفها.

Improper access controls exist within the Snapshot Model component. This issue allows remote exploitation via the `/api/v1/snapshots` endpoint, specifically affecting the `SnapshotPolicy.viewAny()` and `SnapshotPolicy.view()` functions.

A path traversal issue exists in the database-servers API endpoint within the file `app/Http/Requests/Api/V1/RestoreRequest.php`. A remote attacker can exploit this by manipulating the `schema name` argument. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

A path traversal flaw exists in the Public Journey Photo Proxy component within the file `server/src/nest/journey/journey-public.controller.ts`. This issue allows a remote attacker to perform a manipulation that results in unauthorized access to files and directories. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

An issue exists in the Journey Photo Proxy component where the `validateShareTokenForAsset()` function can be manipulated. This flaw allows a remote attacker to achieve incorrect authorization, although the attack is characterized by high complexity and is difficult to exploit.

Remote manipulation of the `loginUser()` function within the `server/src/services/authService.ts` file of the Pre-2FA mfa token Handler component leads to improper authentication.

An issue in the Journey Entry Update component allows for remote SQL injection. This occurs within the `journeyService.updateEntry()` function located in the server/src/nest/journey/journey.controller.t file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

An issue in the OIDC Service component within the `findOrCreateUser()` function of the `server/src/services/oidcService.ts` file allows for improper authentication. This flaw can be exploited remotely, although the attack requires a high level of complexity and is considered difficult to execute.