Jeremy Choi

يوجد ثغرة أمنية تتمثل في فشل الوكيل في إزالة رؤوس الهوية التي يزودها العميل في المسارات التي تم تكوينها لتجاوز المصادقة عبر الإعداد `skip-auth-regex`. وهذا يسمح لمهاجم غير مصدق عليه بإدخال رؤوس هوية مزورة، وتحديدًا `X-Forwarded-User` و`X-Forwarded-Email` و`X-Forwarded-Access-Token`، والتي يتم إعادة توجيهها بعد ذلك إلى التطبيق الأعلى.

يوجد عيب يتمثل في أن الوكيل يقوم بتعيين رؤوس الهوية المصادق عليها باستخدام مفاتيح متغيرة بالشرطة، مثل ’X-Forwarded-User‘، ولكنه يفشل في إزالة المفاتيح المتغيرة بالشرطة السفلية، مثل ’X Forwarded User‘، من الطلبات الواردة. ونظرًا لأن أطر عمل WSGI وPHP تقوم بتوحيد كلا النوعين إلى نفس المتغير، يمكن لمستخدم مصادق عليه ذي امتيازات منخفضة تهريب هوية مزورة. قد يسمح ذلك للهوية المزورة بتجاوز الهوية الشرعية المصادق عليها داخل التطبيق الأعلى.

The issue is related to missing security-related HTTP headers in Red Hat Advanced Cluster Security (RHACS), which could allow an attacker to perform a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page that deceptively points to valid RHACS endpoints, potentially hijacking the user's account permissions to perform other actions.

A Cross-Site Request Forgery (CSRF) issue was discovered, which can be exploited when preflight checks are not performed or are bypassed. This can affect authorized users using older browsers with Adobe Flash when targeted by an attacker.

A CSRF issue was found in the web console, which uses 'Basic authentication', and the REST API lacks a CSRF attack protection mechanism. This allows an attacker to obtain credentials and the Authorization: header when requesting the REST API via a web browser.

The issue is related to shell command injection flaws in Openshift, caused by unsanitized data being passed into shell commands.

The issue allows the API to be used for creating applications via cartridge cache.rb, where the `URI.prase()` function can be exploited to perform command injection.

The issue concerns a problem where the OpenShift cartridge allows remote URL retrieval.

The issue is related to the configuration of Syndesis, specifically with Cross-Origin Resource Sharing (CORS) set to allow all origins, which could be exploited by an attacker to conduct phishing attacks and gain unauthorized access to information. Additionally, there is a vulnerability related to insufficient input validation, which could allow an attacker to obtain unauthorized access to protected information.

Name of the Vulnerable Software and Affected Versions: Perl Crypt::JWT versions prior to 0.023 Description: The issue allows attackers to bypass authentication by providing a crafted token using the hmac() function. This is due to incorrect access control in the JWT.pm component, specifically at line 614. The attack vector is through network connectivity. Recommendations: For versions prior to 0.023, update to a version after commit b98a59b42ded9f9e51b2560410106207c2152d6c to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

The issue allows remote attackers to perform a reflected XSS attack via dashbuilder. This can be achieved by enticing authenticated users, typically admins, to click on malicious links to the /dashbuilder/Controller endpoint, which contains malicious scripts. Successful exploitation enables the execution of script code within the context of the affected user.

The issue allows remote attackers to post data as any username in the logbook.

A cross-site request forgery issue allows remote attackers to hijack user authentication for requests that modify instances via a crafted web page.

The issue concerns the web console in Red Hat JBoss Operations Network (JON) that does not properly authorize requests to add users with the super user role. This allows remote authenticated users to gain admin privileges via a crafted POST request to an unspecified API endpoint.

The issue concerns the dashbuilder component in Red Hat JBoss BPM Suite, which fails to properly handle CSRF tokens. This allows remote attackers to bypass CSRF protection mechanisms or conduct cross-site request forgery attacks by obtaining an old token.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the admin pages of dashbuilder. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies, as the HTTPOnly flag is not included in a Set-Cookie header for session cookies.

The issue allows remote attackers to hijack web sessions. This is achieved via the session id cookie.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.