Jeremy Choi

Uma falha existe onde o proxy não remove cabeçalhos de identidade fornecidos pelo cliente em caminhos configurados para ignorar a autenticação através da configuração `skip-auth-regex`. Isso permite que um invasor não autenticado injete cabeçalhos de identidade forjados, especificamente `X-Forwarded-User`, `X-Forwarded-Email` e `X-Forwarded-Access-Token`, que são então encaminhados para a aplicação upstream.

Uma falha existe onde o proxy define cabeçalhos de identidade autenticados usando chaves de variante com hífen, como 'X-Forwarded-User', mas não remove chaves de variante com sublinhado, como 'X Forwarded User', das requisições recebidas. Como os frameworks WSGI e PHP normalizam ambas as variantes para a mesma variável, um usuário autenticado de baixo privilégio pode contrabandear uma identidade forjada. Isso pode permitir que a identidade forjada substitua a identidade autenticada legítima na aplicação upstream.

The issue is related to missing security-related HTTP headers in Red Hat Advanced Cluster Security (RHACS), which could allow an attacker to perform a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page that deceptively points to valid RHACS endpoints, potentially hijacking the user's account permissions to perform other actions.

Foi descoberta uma vulnerabilidade de falsificação de solicitação entre sites (CSRF), que pode ser explorada quando as verificações prévias não são realizadas ou são contornadas. Isso pode afetar usuários autorizados que utilizam navegadores mais antigos com o Adobe Flash quando alvo de um invasor.

A CSRF issue was found in the web console, which uses 'Basic authentication', and the REST API lacks a CSRF attack protection mechanism. This allows an attacker to obtain credentials and the Authorization: header when requesting the REST API via a web browser.

The issue is related to shell command injection flaws in Openshift, caused by unsanitized data being passed into shell commands.

The issue allows the API to be used for creating applications via cartridge cache.rb, where the `URI.prase()` function can be exploited to perform command injection.

The issue concerns a problem where the OpenShift cartridge allows remote URL retrieval.

The issue is related to the configuration of Syndesis, specifically with Cross-Origin Resource Sharing (CORS) set to allow all origins, which could be exploited by an attacker to conduct phishing attacks and gain unauthorized access to information. Additionally, there is a vulnerability related to insufficient input validation, which could allow an attacker to obtain unauthorized access to protected information.

Name of the Vulnerable Software and Affected Versions: Perl Crypt::JWT versions prior to 0.023 Description: The issue allows attackers to bypass authentication by providing a crafted token using the hmac() function. This is due to incorrect access control in the JWT.pm component, specifically at line 614. The attack vector is through network connectivity. Recommendations: For versions prior to 0.023, update to a version after commit b98a59b42ded9f9e51b2560410106207c2152d6c to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

The issue allows remote attackers to perform a reflected XSS attack via dashbuilder. This can be achieved by enticing authenticated users, typically admins, to click on malicious links to the /dashbuilder/Controller endpoint, which contains malicious scripts. Successful exploitation enables the execution of script code within the context of the affected user.

The issue allows remote attackers to post data as any username in the logbook.

A cross-site request forgery issue allows remote attackers to hijack user authentication for requests that modify instances via a crafted web page.

The issue concerns the web console in Red Hat JBoss Operations Network (JON) that does not properly authorize requests to add users with the super user role. This allows remote authenticated users to gain admin privileges via a crafted POST request to an unspecified API endpoint.

The issue concerns the dashbuilder component in Red Hat JBoss BPM Suite, which fails to properly handle CSRF tokens. This allows remote attackers to bypass CSRF protection mechanisms or conduct cross-site request forgery attacks by obtaining an old token.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the admin pages of dashbuilder. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies, as the HTTPOnly flag is not included in a Set-Cookie header for session cookies.

The issue allows remote attackers to hijack web sessions. This is achieved via the session id cookie.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.