Kmkz

Existe um problema de cross-site scripting refletido pré-autenticação onde atacantes não autenticados podem injetar e executar JavaScript arbitrário. Isso é feito enviando um parâmetro de consulta `LINK` manipulado para o endpoint '/System/Session-1'. A exploração pode levar à coleta de credenciais, manipulação do fluxo de login, acesso a dados visíveis no navegador e a execução de requisições de mesma origem para endpoints do controlador, incluindo um primitivo de troca de origem contra o controlador interno em cenários de Cloud RIA.

Credenciais codificadas permitem que invasores não autenticados recuperem valores estáticos de `clientId` e `clientSecret` do OAuth incorporados no JavaScript entregue ao frontend, como no arquivo `parameters.js`. Invasores podem usar essas credenciais expostas para reproduzir a parte da aplicação do fluxo de autenticação REDY no endpoint '/web/api/v1/auth/token', comprometendo a garantia de cliente confidencial da implementação OAuth.

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.

An issue was discovered where an attacker can access the server without authentication in the case of a default installation without a security realm reference. This is because the configuration is effectively unsecured, as indicated by the Security Realms documentation in the product's Admin Guide. The vendor supports these unsecured configurations due to valid use cases during development.

An issue allows an attacker to access the administration panel without authentication using `anonymous` access. Once logged in, a misconfiguration permits an anonymous user to deploy a malicious .war file, leading to remote code execution. The vendor notes that anonymous access is not available by default but remains optional for certain use cases, such as development environments.

The issue allows local users to conduct a jailbreak attack and obtain root privileges by overwriting the /etc/shadow file, due to /usr/bin/lua being installed setuid to the itadmin account. This enables a BusyBox jailbreak attack.

The issue allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.