Adam Nurudini

An issue exists in the `searchQueryBuilder()` function of `UtmAssetGroupService` where authenticated attackers can inject arbitrary SQL. This occurs because the `assetType` and `groupName` variables are inserted unsanitized into a native PostgreSQL query using `String.format()`. Exploitation of the GET '/api/utm-asset-groups/searchGroupsByFilter' endpoint allows the execution of arbitrary SQL with DBA privileges, which can lead to full database read, data modification, and potential filesystem access.

An authenticated attacker can trigger a server-side request forgery (SSRF) by providing a malicious metadata URL to the `POST/PUT /api/identity-providers` endpoint. This occurs because the `IdentityProviderService.validateMetadataUrl()` function fails to validate the target host, IP, or scheme. This flaw allows the server to send requests to arbitrary internal or cloud metadata hosts, enabling internal network port scanning and unauthorized access to cloud instance-metadata services.

An authorization flaw exists in the `UTMIncidentCommandWebsocket.processCommand()` function, which handles the '/command/{hostname}' STOMP destination. The system fails to perform role checks or apply a command allowlist before forwarding instructions. Consequently, any authenticated user can send arbitrary operating-system commands via gRPC to any connected agent, leading to command execution on monitored endpoints where agent processes typically operate with root or SYSTEM privileges.

An authentication bypass exists that allows remote attackers to obtain full administrative API access. This occurs because the `InternalApiKeyFilter` accepts a valid `Utm-Internal-Key` header matching the `INTERNAL KEY` environment variable for any endpoint. The implementation lacks path restrictions, constant-time comparison, rate limiting, and audit logging. Attackers possessing this key can bypass user account requirements or JSON Web Tokens (JWT) to create accounts, manage users, exfiltrate data, and modify security rules.

An account enumeration issue exists that allows unauthenticated attackers to identify registered email addresses. By sending requests to the 'POST /api/account/reset-password/init' endpoint, attackers can distinguish between registered and unregistered accounts based on the HTTP response. Registered accounts return a 200 OK response, while unregistered accounts trigger a 500 Internal Server Error containing backend details. This information can be used to facilitate targeted phishing or credential attacks.

Authenticated attackers can perform a server-side request forgery (SSRF), a flaw where the server is tricked into making requests to an unintended location. By providing an unvalidated `url` parameter to the `downloadPdf()` function within the `PdfService`, exposed via the GET '/api/generate-pdf-report' endpoint, attackers can force the web-pdf microservice to access internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service. This allows sensitive internal data to be retrieved and rendered into the resulting PDF file.

Authenticated attackers can read arbitrary entity data by exploiting a JPQL injection issue. The vulnerability exists in the `UtmNetworkScanService.searchPropertyValues()` function, which constructs a JPQL query using `String.format()` and executes it via `em.createQuery()` without proper parameter binding. By sending malicious JPQL through the `value` parameter in the 'GET /api/utm-network-scans/searchPropertyValues' endpoint, attackers can extract sensitive information, including credential tables such as `jhi user`. JPQL (Java Persistence Query Language) is an object-oriented query language used to perform database operations on entities.

Authenticated users can achieve remote code execution by uploading a PHP file containing valid image magic bytes through the photo upload endpoint. The `FileUpload::manageFile()` function in `fileupload.class.php` fails to update the file extension after MIME validation. This allows a `.php` extension controlled by the attacker to remain on the disk and execute as PHP via PHP-FPM when the file is retrieved.

Authenticated users can extract arbitrary data from the database via a blind SQL injection. This occurs when the `check photo` parameter is submitted as an array, bypassing the `clean requests()` sanitization function in ClipBucket.class.php. Unsanitized array elements are passed through the bulk deletion handler in the 'manage photos.php' endpoint to the `photo exists()` function in photos.class.php, where non-numeric values are interpolated directly into a SQL query. This allows for time-based blind SQL injection, a technique that infers data by observing the time the server takes to respond to specific queries, to retrieve credential hashes and other sensitive information.

Authenticated users can extract arbitrary database contents, including user credential hashes and email addresses, through a time-based blind SQL injection. This occurs when the `msg id` parameter is submitted as an array to bypass the `clean requests()` sanitization function in ClipBucket.class.php. The unsanitized array elements are passed through the deletion handler in 'private message.php' into the `cb pm::delete msg()` function, which interpolates the unescaped message ID directly into a SQL query string.

The web installer fails to properly validate or escape the `php cli filepath` parameter before passing it to shell execution. This allows unauthenticated attackers to submit a crafted POST request to the installer with a malicious value in the `php cli filepath` variable to execute arbitrary commands as the web server user.

Authenticated users can read arbitrary files by providing crafted filenames containing directory traversal sequences to the export download endpoint. By manipulating the `filename` parameter, an attacker can escape the intended export directory and access files outside of it that are readable by the application process. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

An authentication bypass exists due to a duplicate `Auth::routes()` call in the `routes/web.php` file, which inadvertently re-enables the `POST /register` endpoint after it had been disabled. This allows unauthenticated attackers to self-register accounts. Because the registration controller does not assign a specific role and the `users.role` column defaults to Admin, newly created accounts are granted full Administrator privileges. This can lead to unauthorized access to stored device credentials, user data, and the issuance of API tokens.

Authenticated attackers can read arbitrary files by supplying unsanitized directory traversal sequences in the `filename` GET parameter of the `download export()` method. By using `../` sequences, an attacker can escape the exports base directory to access sensitive files readable by the web server process, such as application environment files containing database credentials, encryption keys, and mail configuration.