Wu Yulun

Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.

Existe uma falha de bypass de autenticação no componente `ns-admin`. Atacantes remotos não autenticados podem forjar tokens de administrador utilizando uma chave de assinatura JWT hardcoded para assinar um `X-Access-Token` usando o algoritmo HS256. Ao incluir o ID de função de super administrador público, um atacante pode obter acesso total ao gerenciamento de usuários, tarefas de varredura e resultados armazenados.

NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.

Um problema de cross-site scripting armazenado existe onde usuários registrados podem injetar scripts ao colocar aspas duplas em tokens de classe de linguagem dentro de `markdown-it-xss.ts`. Um invasor pode armazenar um payload malicioso em sua bio de perfil, que é executado quando administradores ou outros usuários visualizam o perfil. Isso pode levar ao roubo do cookie de sessão `sid` não-httpOnly, permitindo o sequestro de sessão.

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

Existe uma falha de bypass de autenticação que permite que atacantes não autenticados definam um código de verificação de login por SMS personalizado. Ao fornecer um valor específico ao campo `Code` no endpoint '/admin/sms/send', um atacante que conheça o número de celular de um usuário pode definir o código de verificação e, posteriormente, utilizá-lo no endpoint '/admin/site/mobileLogin' para assumir contas, incluindo contas de administradores.

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda wiki token JWT for session takeover.