Niels Teusink

The `RequestHandlerComponent` automatically decodes XML request bodies on all write requests. A logic error exists in the `Xml::build()` library within its `readFile` guard condition due to PHP operator precedence, which allows the HTTPS branch to bypass the `readFile` check. Consequently, a request body containing a bare HTTPS URL is treated as a locator and fetched by the server. Since the `/cspReport` endpoint accepts XML content types and is unauthenticated, a remote attacker can send a POST request with a crafted XML body to force the server to issue outbound HTTPS requests to arbitrary targets. This can be used to probe internal services, trigger actions on internal HTTPS endpoints, or perform timing-based reconnaissance of the network environment.

Installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at `/var/log/misp install.log` and a named pipe (FIFO) at `/var/log/misp install.log.pipe` to capture output. These files contain sensitive information, including the generated admin password, database passwords, GPG passphrase, and supervisor password. Because the log file is created using the `tee` command and the FIFO is created via `mkfifo` without explicit modes, both inherit the system default umask, making them world-readable. This allows any local unprivileged user to read the credentials. Furthermore, the installer does not remove the log file before creation, which could allow a pre-existing symlink in `/var/log` to redirect writes to an arbitrary location.

A reflected cross-site scripting (XSS) issue exists in the event REST search export confirmation form. The view template `app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp` renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's `json encode()` function without hex-encoding flags. Since `json encode()` does not escape single quotes by default, an attacker can inject a single-quote character to terminate the string and execute arbitrary JavaScript in the browser session of an authenticated user who navigates to a crafted URL. This affects the Default and UiBeta themes. Successful exploitation can lead to session hijacking, unauthorized actions, or exfiltration of sensitive session data.

A flaw in the background job dispatch mechanism allows remote code execution with the privileges of the web user. The issue occurs because background job arguments are passed directly as the `argv` of the CakePHP console process. The `ShellDispatcher:: parsePaths()` function scans `argv` for path switches such as `-app`, `--app`, `-working`, `--working`, `-root`, `--root`, `-webroot`, and `--webroot`, using the subsequent element as the application root. Specifically, the 'events/contact' endpoint forwards the `message` and `person` fields into job arguments without validation. An attacker can set the `person` field to a reserved switch and the `message` field to a `phar://` URI (a PHP archive wrapper) pointing to a malicious archive. This causes the CakePHP bootstrap to include `Config/core.php` from the archive, executing arbitrary PHP code. This allows for data exfiltration, persistence, and lateral movement within the host.

Name of the Vulnerable Software and Affected Versions: Zyxel USG devices version 4.60 Description: The issue concerns an undocumented account `zyfwp` with an unchangeable password that can be found in cleartext in the firmware of Zyxel USG devices. This account allows someone to login to the ssh server or web interface with admin privileges. The password for this account is `PrOw!aN fXp`. There is a significant increase in attempts to access this known SSH backdoor using these undocumented credentials. Recommendations: For Zyxel USG devices version 4.60, consider disabling the `zyfwp` account until a patch is available. Restrict access to the ssh server and web interface to minimize the risk of exploitation. Avoid using the `zyfwp` account and its associated password `PrOw!aN fXp` until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to errors in processing files with .LNK (or .PIF) extensions. Exploitation of this issue can allow a remote attacker to execute arbitrary code using a specially crafted .LNK (or .PIF) file. This can occur when Windows Explorer improperly handles icon display for such files. The issue has been demonstrated in the wild and was originally reported for malware leveraging vulnerabilities in Siemens WinCC SCADA systems. An estimated number of affected devices is not provided, but the issue has been observed in real-world incidents. Technical details include the exploitation of `Windows Shell` in Microsoft Windows, where a crafted (1) `.LNK` or (2) `.PIF` shortcut file is not properly handled during icon display.

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7 Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a `username` string that is used by the `ypmatch` program. This is due to a problem in the `map yp alias` function in `functions/imap general.php`. Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting the input for the `username` string to prevent the use of shell metacharacters until a patch is available.

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7 Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is possible through various vectors, including certain encrypted strings in e-mail headers related to contrib/decrypt headers.php, PHP SELF, and the query string. Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the contrib/decrypt headers.php module and limiting the use of PHP SELF and query strings in affected API endpoints until a patch is available.

Name of the Vulnerable Software and Affected Versions: GrabIt versions 1.7.2 Beta 3 and earlier Description: The issue is related to a stack-based buffer overflow in the NZB importer feature. This can be exploited by remote attackers through a crafted DTD reference in a DOCTYPE element in an NZB file, allowing them to execute arbitrary code. Recommendations: For GrabIt versions 1.7.2 Beta 3 and earlier, consider disabling the NZB importer feature until a patch is available to prevent potential exploitation.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote web sites on the browser's whitelist to execute arbitrary Javascript with chrome privileges. This can lead to arbitrary code execution on the system when combined with other vulnerabilities. The exploitation can be demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site. Recommendations: For Firefox version 1.0.3, consider restricting access to the `install` function until a patch is available. As a temporary workaround, avoid using the `javascript:` URL scheme for package icons to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote attackers to execute arbitrary Javascript in other domains. This is achieved by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution. Recommendations: For Firefox version 1.0.3, update to a newer version to mitigate the risk.

The issue allows remote attackers to execute arbitrary SQL and gain privileges. This is achieved via the `search id` parameter in the "search.php" file.