Alexandre Dulaunoy

A heap-based buffer overflow occurs in the `fanx fingerprint()` function within the `ssl/sslxprint.c` file. The issue arises from a miscalculation of the required buffer size when formatting FAN/1 X.509 certificate fingerprints; the allocation uses a fixed value of 31 bytes, while the format string actually requires 34 bytes including the null terminator. Because `sprintf` writes the formatted string without bounds checking, a 3-byte overflow occurs on every invocation with valid inputs. An attacker can trigger this by providing a crafted pcap file containing a TLS X.509 certificate to a user running the tool with FAN/1 fingerprinting enabled. This heap corruption can lead to a denial of service via a crash or potentially allow arbitrary code execution.

The `CakeResponse::download()` function in `lib/Cake/Network/CakeResponse.php` fails to sanitize caller-supplied filenames when constructing the Content-Disposition header. This leads to two injection vectors: the use of C0 control characters (CR or LF) can cause PHP to drop the Content-Disposition header, resulting in the response body rendering inline in the browser, and the use of double-quote characters can terminate the quoted-string value early to inject additional header parameters. An authenticated user can upload an attachment with a crafted filename that, when viewed by another authenticated user, allows for header manipulation and the execution of arbitrary HTML or JavaScript. This condition enables stored cross-site scripting, which can lead to session hijacking, data exfiltration, and unauthorized actions.

Critical infrastructure settings, specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin, are exposed through the web UI and API to site-admin users. Because background job workers trust raw Redis job payloads without additional validation, an attacker with a hijacked site-admin session can redirect these settings to an attacker-controlled Redis server and restart the workers. This allows the injection of malicious job payloads, leading to arbitrary command execution as the worker account and potential data exfiltration. Furthermore, the `download attachments on load` setting, which manages inline attachment rendering, is modifiable via the same interface, potentially facilitating client-side attacks.

The account recovery functionality contains a time-of-check-to-time-of-use (TOCTOU) race condition—a scenario where a system checks a condition and then uses the result, but the condition changes between the check and the use—during the consumption of single-use recovery tokens. This occurs because the system verifies the token nonce and clears it in separate database operations. Consequently, two concurrent HTTP requests using the same valid token can both pass verification, allowing an attacker with a valid token to overwrite a legitimate user's password. Additionally, the `/user/confirm account/<token>` endpoint allows setting empty or trivially short passwords because the view handler performs a manual equality comparison between password fields without invoking the form's validation logic, bypassing complexity and length constraints. The issue resides in the `User` model (`website/models/user.py`) and the view layer (`website/web/views/user.py`).

A server-side request forgery (SSRF) issue exists in the remote-instance synchronization functionality. The system validated remote instance addresses only for basic URL syntax before storage, while the synchronization worker later processed these addresses using `requests.get()` with automatic redirect handling and no network-boundary restrictions. An authenticated administrator with `admin:access` permission could configure a remote instance pointing to internal, loopback, link-local, or cloud metadata HTTP(S) services. Additionally, a publicly accessible URL could be used to redirect to an internal destination since redirects were followed without revalidation. This allows a privileged attacker to probe or interact with services accessible from the server's network context, such as private network services or cloud instance metadata endpoints.

A stored cross-site scripting (XSS) issue exists in the `render tag badges` Jinja filter used to display reference tags for vulnerability records. The application directly interpolates values from `containers.cna.references[].tags[]` into HTML badge elements and wraps the result in `markupsafe.Markup`, which bypasses Jinja's automatic HTML escaping. An authenticated user with `vulnerability:create` or `vulnerability:modify` permissions can submit crafted reference tags via the CNA API containing arbitrary HTML or JavaScript. This malicious content is stored and subsequently executed in the browser of any user visiting the public `/cve/<id>` or `/vuln/<id>` endpoints. This could allow an attacker to perform actions on behalf of the victim, access session information, or modify page content, potentially affecting unauthenticated users.

An authorization bypass exists due to inconsistent enforcement between the REST API and the Server-Sent Events (SSE) streaming interface. The Pub/Sub interface uses a `token required` decorator that authenticates requests by matching the `X-API-KEY` header against a user API key but fails to verify if the account is active or confirmed. Since API keys are issued during self-registration before confirmation is complete, unauthorized users can access the `/pubsub/subscribe/<topic>` endpoint. This allows access to stream events, such as unmoderated comments, that are otherwise restricted via the REST API.

An authentication weakness exists in the account activation and password-recovery mechanism. The system uses stateless signed tokens containing only the user's login. While the signature and age are validated, the application fails to track if a token has already been used. Consequently, a captured activation or recovery link remains valid for the duration of the `TOKEN VALIDITY PERIOD`, even after a password change. This allows an attacker with a valid token to replay it multiple times to reset the password and take control of the account. Furthermore, tokens are not bound to a specific purpose, enabling the same token to be used for both activation and recovery workflows. Exploitation requires obtaining a valid link but does not require the victim's current password or an active session.

A Server-Side Request Forgery (SSRF) protection bypass exists in the `html to markdown` expansion module. The module fails to normalize IPv4-mapped IPv6 addresses before comparing them against blocked ranges for loopback, private, and link-local IP addresses. An authenticated attacker can provide an IPv4-mapped IPv6 address or a hostname that resolves to one to bypass these filters. This allows the server to connect to internal web services, administrative interfaces, or cloud instance metadata, with the retrieved content returned to the attacker as converted Markdown.

An unauthenticated improper input validation issue exists in the 'POST /fetch cve data' endpoint. A remote attacker can manipulate request parameters that control the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This flaw can expose administrative usernames and password hashes from the `mgmt users` collection, which may lead to offline password cracking and the compromise of administrative accounts.

A stored cross-site scripting issue exists in the tag rendering code. Several client-side rendering paths interpolate tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. An attacker capable of creating or influencing stored tag or metadata values can inject a crafted payload. When a victim views affected BSimVis pages, the payload executes arbitrary JavaScript in their session, potentially allowing the attacker to perform actions as the victim, read available data, or alter application content.

An issue exists in the external reference URL probe functionality within `app/case/task.py`. An attacker can submit an external reference URL to force the application server to issue an HTTP HEAD request to a specified destination. Due to insufficient validation of the URL scheme and resolved destination address, this allows requests to loopback, link-local, private, reserved, or other restricted network resources. This may enable interaction with internal services or cloud metadata endpoints from the server's network context. This is a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location.