Łukasz Bawolski

Improper access control in the annotation functionality allows authenticated users to create and disclose comments without authorization. The 'addAnnotation' and 'listAnnotation' APIs perform an ownership check when an entity's UUID is specified but do not correctly honor the result. Consequently, any authenticated user can write annotations to or view existing annotations on an entity they do not own by providing its `UUID`.

An OS Command Injection issue exists in the NAS backup provider plugin. The 'addBackupRepository' and 'updateBackupRepository' API endpoints accept unsanitized command options for the backup repository. A malicious operator account can exploit this to inject arbitrary commands that execute on the KVM hypervisor host when a backup restore is performed by any account.

An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist.

An issue in the LDAP authentication plugin allows authenticated users to access sensitive information while listing LDAP providers. Any user with access to the 'listLdapConfigurations' API, which is available to all default roles by default, can list LDAP configurations.

Improper encoding or escaping of output in the user interface occurs when using the Instance Reset Password functionality. This leads to a Cross-Site Scripting (XSS) issue, where malicious scripts can be injected into web pages viewed by other users.

Command Injection occurs in the run and get diagnostics functionality for system VMs and virtual routers. An authenticated user with necessary permissions can execute arbitrary commands on system VM and Virtual Router instances, running as root or the diagnostics-process user. This can lead to a full compromise of the instance and potentially allow lateral movement within the managed infrastructure, including access to guest network traffic. The affected API endpoints are `getDiagnosticsData` and `runDiagnostics`, which are restricted to Admin role accounts by default.

An issue in the Webhook module allows the exposure of sensitive information to unauthorized actors during the process of listing and deleting deliveries.

The Kenik Camera management Panel is affected by a path traversal issue. This allows an unauthenticated attacker to send a GET request containing an arbitrary file path to read files stored on the server. Path traversal is a flaw that allows attackers to access files and directories that are stored outside the web root folder.