Springkill

توجد ثغرة أمنية تسمح بتنفيذ التعليمات البرمجية عن بُعد (RCE) عبر حقن XML في Apache HertzBeat بسبب معالجة استجابات XML لخريطة الموقع HTTP. يمكن للمهاجم الذي يمتلك حسابًا مصدقًا عليه ووصولاً إلى النظام استغلال هذه الثغرة عن طريق إضافة أداة مراقبة تعالج XML وتُرجع محتوى مصممًا خصيصًا.

The issue allows attackers to forge JWT and take over services due to the JWT secret being hardcoded in the code. Additionally, the UID and OID are also hardcoded. This has been fixed in version 2.10.2.

The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. However, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.

DataEase is an open source data visualization analysis tool. The PostgreSQL data source function allows customization of JDBC connection parameters and the PG server target. However, the PgConfiguration class in backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java does not filter any parameters and directly concatenates user input. This allows an attacker to add parameters to the JDBC URL and connect to a malicious PG server, triggering the PG JDBC deserialization vulnerability. The attacker can then execute system commands and obtain server privileges through the deserialization vulnerability.

A vulnerability was found in the function `filterKeyword`. The manipulation of the argument `value` leads to resource consumption.