Thaidn

توجد مشكلة حيث يفشل النظام في التحقق مما إذا كان نطاق الاسم (namespace) أو قاعدة البيانات التي اختارها المتصل تتطابق مع مستوى مصادقة مستخدم النظام على مستوى نطاق الاسم أو قاعدة البيانات، مما يسمح بالوصول عبر المستأجرين (cross-tenant). يمكن للمهاجم المصادق عليه التلاعب بترويسات `Surreal-NS` و `Surreal-DB` على نقطة النهاية '/sql' أو استخدام طريقة RPC `use()` لإجراء عمليات غير مصرح بها، بما في ذلك قراءة وإنشاء وتعديل وحذف الصفوف، وكذلك قراءة قيم `DEFINE PARAM` في مستأجر آخر، بشرط أن تسمح أذونات الجدول (PERMISSIONS) بهذه الإجراءات.

Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the `service name` and `span name` fields into ClickHouse string literals without proper escaping.

The HTTP handler fails to apply authorization wrappers to trace-funnel analytics endpoints. This allows unauthenticated attackers to submit arbitrary funnel definitions to retrieve trace analytics, including identifiers, durations, span counts, service topology, and error activity, without providing credentials.

The Kubernetes ingress-nginx provider mishandles Ingresses that contain both an authentication annotation and the `nginx.ingress.kubernetes.io/from-to-www-redirect` annotation. This causes the provider to create a sibling router that matches only on the host and utilizes the RedirectRegex middleware while pointing to the protected backend service. Since RedirectRegex is not a terminal handler, requests that do not match its pattern are forwarded to the backend. By using a crafted Host header with a non-numeric or empty port (e.g., 'Host: www.example.com:x'), an attacker can select this sibling router and bypass the redirect. This results in the request being proxied to the protected backend without any annotation-derived middlewares being applied, effectively bypassing authentication (such as BasicAuth) and source-IP allowlisting.

A weak robustness vulnerability exists in the AWS Encryption SDKs due to the non-committing property of AES-GCM and other AEAD ciphers. This allows an attacker to craft a unique ciphertext that decrypts to multiple different results, particularly in a multi-recipient setting. The vulnerability also enables information leakage and ciphertext forgery attacks. An attacker can create ciphertexts that leak the user's AWS account ID, encryption context, user agent, and IP address upon decryption. Additionally, an attacker can create ciphertexts that are accepted by other users. The non-committing property of AES-GCM can cause nonidentical plaintexts when decrypting a single ciphertext with two different keys.