Thibaud Kehler

The login form "/Login" performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly. This issue is related to the API endpoint "/Login" and can be exploited by repeatedly requesting this endpoint.

A Server-Side Request Forgery issue allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the `server` parameter to the "/cwc/login" login form.

The issue allows an attacker to confirm a single character of a user's password hash using a specially crafted regular expression filter in the "users" endpoint of the REST API. Multiple requests can eventually uncover the entire hash. The hash is not present in the response, but the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time-intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default.

An issue was discovered in several functions, which are vulnerable to reflected XSS. This is demonstrated by various API endpoints, such as "private/index.jsp?partners/ShowNonLocalPartners.do?localID=", "private/index.jsp", "private/index.jsp?database/databaseTab.jsp", "private/index.jsp?activation/activationMainTab.jsp", "private/index.jsp?communication/serverTab.jsp", and "private/index.jsp?emailNotification/notificationTab.jsp".

The issue allows Directory Traversal.

The issue allows remote attackers to upload, copy, and modify files on the filesystem, potentially leading to arbitrary code execution. This is achieved via various parameters in different controllers, such as the `filename` parameter to `BlueimpController.php`, the `dzchunkindex`, `dzuuid`, or `filename` parameter to `DropzoneController.php`, the `qqpartindex`, `qqfilename`, or `qquuid` parameter to `FineUploaderController.php`, the `x-file-id` or `x-file-name` parameter to `MooUploadController.php`, or the `name` or `chunk` parameter to `PluploadController.php`. The vulnerability can be exploited by any users with legitimate access to the upload functionality and can lead to arbitrary code execution, denial of service, and disclosure of confidential information.