0Xkakash1

A Server-Side Request Forgery (SSRF) issue exists in the webhooks feature. This allows staff users to probe internal hosts from the Ghost server. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

A server-side request forgery (SSRF) issue exists in the webhooks feature. This allows users with staff privileges to craft requests that enable the Ghost server to probe and access internal network resources.

The `parse options header` function parsed `Content-Disposition` and `Content-Type` headers using `email.message.Message`, which applies RFC 2231/5987 decoding. This allows extended parameter syntax, such as `filename*`, `name*`, and continuation forms (`filename*0`, `filename*1`), to override plain parameters when both are present. However, RFC 7578 §4.2 explicitly forbids the `filename*` form in `multipart/form-data`. This creates an interpretation conflict where upstream components (such as WAFs, proxies, or gateways) that follow RFC 7578 or do not implement RFC 2231/5987 decoding may interpret headers differently than the backend. An attacker can exploit this to smuggle a different field name or filename past an inspector. This affects the `parse options header`, `FormParser`, `create form parser`, and `parse form` APIs, and impacts Starlette/FastAPI via `request.form()`, exposing smuggled values as form field names or `UploadFile.filename`. Potential consequences include bypassing access or upload controls based on field names or filenames, and path traversal if the application builds filesystem paths from the parsed filename without sanitization, as percent-encoded sequences like `..%2F` are decoded.

Name of the Vulnerable Software and Affected Versions: Nhost versions prior to 0.48.0 Description: Nhost's auth service OAuth provider callback flow includes the refresh token directly in the redirect URL as a query parameter. This can lead to exposure of the refresh token in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. The refresh token is one-time use, and these leak vectors are on infrastructure or services integrated by the application developer. The vulnerable code is located in `services/auth/go/controller/sign in provider callback get.go` within the `signinProviderProviderCallback` function (lines 257-261), where the refresh token is added as a query parameter to the redirect URL. The issue affects all OAuth provider flows (GitHub, Google, Apple, etc.). Recommendations: Update to version 0.48.0 or later.

A path traversal issue exists in the `serveStatic()` function. In Node.js deployments, the `event.url.pathname` is not normalized, allowing percent-encoded dot segments (%2e%2e) to be passed to `decodeURI()` and decoded into `../` sequences without proper sanitization. This allows an unauthenticated remote attacker to send crafted requests to endpoints served by `serveStatic()` to read arbitrary files located outside the intended static directory.

SiYuan, a personal knowledge management system, is affected by a critical issue allowing for cross-site scripting (XSS) that can escalate to remote code execution (RCE). The Bazaar (community marketplace) renders package metadata fields, specifically 'displayName' and 'description', using template literals without proper HTML escaping. This allows a malicious package author to inject arbitrary HTML and JavaScript code into these fields. When any user browses the Bazaar page, this injected code automatically executes. Due to SiYuan's Electron configuration enabling `nodeIntegration: true` with `contextIsolation: false`, the XSS vulnerability directly escalates to full RCE on the victim's operating system, requiring no user interaction beyond opening the marketplace tab. The vulnerable code is located in `app/src/config/bazaar.ts:275-277` and `app/electron/main.js:422-426`. A proof of concept demonstrates the ability to execute arbitrary commands, such as launching 'calc.exe' or establishing a reverse shell, simply by browsing the Bazaar page. This vulnerability poses a significant supply-chain risk to the entire SiYuan user community. Attackers can potentially steal API tokens, session cookies, SSH keys, browser credentials, and arbitrary files, or install persistent backdoors and ransomware. The issue affects all supported platforms: Windows, macOS, and Linux.

ApostropheCMS contains a flaw in the bearer token authentication middleware located in `@apostrophecms/express/index.js`. An incorrect MongoDB query allows incomplete login tokens – where password verification occurred but multi-factor authentication (MFA) requirements were not met – to be utilized as fully authenticated bearer tokens. This bypasses MFA for any ApostropheCMS deployment utilizing `@apostrophecms/login-totp` or custom `afterPasswordVerified` login requirements. The issue stems from the use of the `$ne: []` MongoDB operator in the query, which incorrectly matches tokens with unverified requirements. Additionally, a separate bug in `@apostrophecms/login/index.js` prevents the deletion of incomplete tokens, exacerbating the vulnerability. An attacker with a victim's username and password, but lacking their TOTP code, can exploit this flaw to gain full API access. The API endpoint **/api/v1/@apostrophecms/page** is accessible with the compromised bearer token. The vulnerable parameter is the bearer token itself, passed in the `Authorization` header.

SiYuan is a personal knowledge management system. The backend 'renderREADME' function uses 'lute.New()' without calling 'SetSanitize(true)', allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to 'innerHTML' without additional sanitization. A malicious package author can embed arbitrary JavaScript in their README, which executes when a user clicks to view the package details. Because SiYuan's Electron configuration enables 'nodeIntegration: true' with 'contextIsolation: false', this cross-site scripting (XSS) escalates directly to full Remote Code Execution (RCE). The backend function affected is `renderREADME` located in `kernel/bazaar/package.go:635-645`. The frontend assignment occurs in `app/src/config/bazaar.ts:607`. The Electron configuration is found in `app/electron/main.js:422-426`. The issue was exploited through the Bazaar (community marketplace) by submitting a malicious package with a crafted README file. Attackers can leverage various HTML elements like `img`, `svg`, `details`, and `picture` to hide payloads. Exploitation can lead to full remote code execution, data theft, and the installation of persistent backdoors.

The `createEventStream` function in H3 is susceptible to Server-Sent Events (SSE) injection due to a lack of newline sanitization within the `formatEventStreamMessage()` and `formatEventStreamComment()` functions. An attacker controlling any part of an SSE message field – `id`, `event`, `data`, or comment – can inject arbitrary SSE events to connected clients. The SSE protocol relies on newline characters as field delimiters and double newlines as event separators. The absence of newline sanitization allows attackers to inject new fields, events, manipulate reconnection behavior, and override the Last-Event-ID. This can lead to cross-user content injection, phishing attacks, event spoofing, denial-of-service through aggressive reconnection attempts, and manipulation of event replay on reconnection. The issue resides in `src/utils/internal/event-stream.ts`, lines 170-187.

Nhost’s storage service’s file upload handler relies on the `Content-Type` header provided by the client without verifying the file’s actual MIME type. This allows an attacker to upload files with a manipulated MIME type, bypassing any restrictions based on MIME types configured on storage buckets. The vulnerable component is the `services/storage` service, specifically within the `getMultipartFile` function (lines 48-70) in the `upload files.go` file. The function skips MIME type detection if the client provides a `Content-Type` that is not `application/octet-stream`, directly using the client-provided value. This can lead to incorrect MIME type metadata associated with the uploaded file, potentially causing issues with how the file is handled by consuming systems. The vulnerable parameter is `Content-Type`.

SiYuan, a personal knowledge management system, has a flaw in its WebSocket endpoint ('/ws') that permits unauthenticated connections when specific URL parameters are used ('?app=siyuan&id=auth&type=auth'). This bypass, originally intended for the login page to maintain a live kernel connection, enables any external client, including malicious websites through cross-origin WebSocket connections, to connect and receive all server push events in real-time. These events expose sensitive document metadata, including document titles, notebook names, file paths, and all Create, Read, Update, and Delete (CRUD) operations performed by authenticated users. The absence of Origin header validation allows a malicious website to silently connect to a victim's local SiYuan instance and monitor their note-taking activity. The vulnerable component is located in the file `kernel/server/serve.go:728-731` within the `serveWebSocket()` function and its `HandleConnect` handler.

SiYuan is a personal knowledge management system. The mobile file tree component (`MobileFiles.ts`) renders notebook names using `innerHTML` without proper HTML escaping when processing `renamenotebook` WebSocket events. The desktop version (`Files.ts`) correctly utilizes `escapeHtml()` for the same operation. This allows an authenticated user with notebook renaming privileges to inject arbitrary HTML and JavaScript code, which will be executed on any mobile client displaying the file tree. The Electron environment is configured with `nodeIntegration: true` and `contextIsolation: false`, granting the injected JavaScript full access to Node.js functionalities. This escalates a stored cross-site scripting (XSS) issue to full remote code execution. The mobile layout is also used in the Electron desktop application when the window is narrow, making the issue exploitable on desktop as well. The backend API endpoint `POST /api/notebook/renameNotebook` is involved in this process, and the vulnerable code is located in `app/src/mobile/dock/MobileFiles.ts:77`. The backend component `kernel/api/notebook.go:104-116` sends unescaped names.

SiYuan fails to sanitize package metadata and README content within the Bazaar marketplace. This allows malicious authors to inject arbitrary HTML and JavaScript through the `displayName`, `description`, or `README` fields. Because the application is built on Electron with `nodeIntegration` enabled—a setting that allows JavaScript to access Node.js APIs—the injected scripts can escape the browser context to execute operating system commands, resulting in remote code execution on the device of any user browsing the marketplace.

SiYuan fails to sanitize package metadata and README content within the Bazaar marketplace. This allows malicious authors to inject arbitrary HTML and JavaScript into the `displayName`, `description`, or `README` fields. Because the application is built on Electron with the `nodeIntegration` setting enabled, these Cross-Site Scripting (XSS) payloads can escape the browser context to execute operating system commands, leading to remote code execution on the device of any user browsing the marketplace.

Dagu is a workflow engine with a built-in web user interface. When configured with HTTP Basic authentication (DAGU AUTH MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without credentials. This allows unauthenticated attackers to access real-time DAG execution data, workflow configurations, execution logs, and queue status, bypassing the authentication that protects the REST API. The issue stems from the `buildStreamAuthOptions()` function, which returns an authentication structure with `BasicAuthEnabled` set to true but `AuthRequired` defaulting to false. The authentication middleware allows unauthenticated requests when `AuthRequired` is false. Affected SSE endpoints include '/api/v1/events/dags', '/api/v1/events/dags/{fileName}', '/api/v1/events/dag-runs', '/api/v1/events/dag-runs/{name}/{dagRunId}', '/api/v1/events/dag-runs/{name}/{dagRunId}/logs', '/api/v1/events/queues', '/api/v1/events/docs-tree', and '/api/v1/events/docs/*'. An attacker can enumerate workflows, monitor execution in real-time, read execution logs, and map infrastructure.

Parse Server, an open source backend deployable on Node.js infrastructures, is affected by a user enumeration issue. The `/verificationEmailRequest` API endpoint returns different error responses based on whether an email address is registered, already verified, or non-existent. An attacker can send requests with various email addresses and analyze the error codes to determine which email addresses are associated with existing user accounts. This issue impacts any Parse Server deployment where email verification is enabled (`verifyUserEmails: true`). A fix introduces the `emailVerifySuccessOnInvalidEmail` option, which, when enabled, returns a generic success response for all verification email requests, preventing differentiation between valid, verified, and non-existent email addresses. The fix also includes strengthened input validation for the `resetPasswordSuccessOnInvalidEmail` option and security checks to warn when enumeration mitigation is disabled.

The `parseBody()` function allows the use of the ` proto ` key when the dot option is enabled. This allows specially crafted form field names to create objects containing ` proto ` properties. If these parsed results are merged into regular JavaScript objects using unsafe merge patterns, it can lead to prototype pollution, which allows an attacker to modify object behavior.

Parse Server, a backend deployable on Node.js infrastructures, is affected by an issue where recovery codes for multi-factor authentication (MFA) via TOTP are not consumed after use. This allows an attacker who obtains a single recovery code to repeatedly authenticate as the affected user without the code being invalidated, undermining the intended single-use design and weakening the security of MFA-protected accounts. The issue arises when MFA via TOTP is enabled for a user account, and Parse Server generates two single-use recovery codes intended as a fallback when a TOTP token is unavailable.

Parse Server is an open-source backend deployable on infrastructures running Node.js. An attacker with access to the master key can inject malicious SQL code through crafted field names used in query constraints when Parse Server is configured with PostgreSQL. The field name within a `$regex` query operator is passed to PostgreSQL using unparameterized string interpolation, enabling manipulation of the SQL query. This SQL injection bypasses Parse Server's abstraction layer and operates directly at the database level. The issue affects deployments utilizing PostgreSQL. The API endpoint is not explicitly mentioned. The vulnerable parameter is the field name used in the `$regex` query operator.

Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its validation process for protected fields. The validation only examines top-level query keys, allowing authenticated users to bypass the protection by embedding query constraints on protected fields within logical operators. This enables unauthorized access and extraction of values from protected fields, as default protected fields exist in all Parse Server deployments.