Akos Jakab

Ollama has a flaw due to insufficient input validation, leading to a path traversal issue. This allows an attacker to overwrite arbitrary files on the server, potentially leading to remote code execution (RCE). Exploitation involved overwriting `/etc/ld.so.preload` to load a malicious shared library, escalating from arbitrary file write to remote code execution. Over 1,000 instances were found to be exposed. The issue occurs because Ollama does not validate the format of the digest (SHA256 with 64 hexadecimal digits) when obtaining the model path, mishandling cases with fewer or more than 64 digits, or when the path begins with a `../` substring.

A memory corruption vulnerability in Fluent Bit's embedded HTTP server allows an unauthenticated attacker to potentially execute arbitrary code, cause a denial of service, or disclose sensitive information. The issue is related to a heap buffer overflow when parsing trace requests. With over 13 billion downloads, Fluent Bit is widely used in major cloud platforms and by tech giants, making this vulnerability particularly concerning. While creating a reliable exploit for remote code execution may be challenging, a proof of concept for denial of service is already publicly available.

Name of the Vulnerable Software and Affected Versions: Apache HugeGraph-Server versions 1.0.0 through 1.3.0 Description: The issue affects Apache HugeGraph-Server, allowing unauthenticated remote code execution and server takeover. This flaw can be exploited by attackers to bypass sandbox restrictions, leading to remote code execution. The vulnerability has been identified in HugeGraph-Server versions 1.0.0 – 1.3.0. It is recommended to upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. The vulnerability is being actively exploited, and users are advised to take immediate action to prevent exploitation. Recommendations: Upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. As a temporary workaround, consider disabling the vulnerable `groovy` injection functionality until a patch is available. Restrict access to the vulnerable `gremlin` endpoint to minimize the risk of exploitation. Avoid using the `groovy` parameter in the affected API endpoint until the issue is resolved.

The issue in XWiki Platform stems from a lack of input validation within the database search functionality. This allows a non-authenticated attacker to achieve remote code execution. The database search is accessible by default to all users, meaning any visitor to a public wiki or user of a closed wiki could potentially exploit this issue, impacting the confidentiality, integrity, and availability of the entire XWiki installation. The vulnerability allows execution of arbitrary code through the search text. The API endpoint involved is `/xwiki/bin/get/Main/DatabaseSearch`. The vulnerable parameter is `text`.

The built-in SSH server allows argument injection in `internal/ssh/ssh.go`, which can lead to remote code execution. Authenticated attackers with at least one SSH key can exploit this by opening an SSH connection and sending a malicious `--split-string` request via the `env` command if the built-in SSH server is enabled (configured as `[server] START SSH SERVER = true`). This allows the attacker to execute arbitrary commands with the privileges of the user specified by `RUN USER` in the configuration, potentially enabling access to or alteration of any user's code on the instance. Windows installations are not affected. Approximately 7,300 to 8,300 exposed instances have been identified.