Arron-Bit

The module upload endpoint 'POST /openmrs/ws/rest/v1/module' is susceptible to a Zip Slip path traversal attack. This occurs during the automatic extraction of uploaded .omod archives within the `startModule()` function of `WebModuleUtil`. The system only verifies if the full entry path starts with `..`, failing to normalize the path or perform boundary checks on entries starting with `web/module/`. Consequently, a crafted archive containing entries such as `web/module/../../../../malicious.jsp` can result in files being written outside the intended module directory. An authenticated attacker with module upload permissions can write arbitrary files to locations like the web application root. By uploading a JSP file and requesting it, the attacker can achieve remote code execution. Additionally, the `module.allow web admin` runtime property, intended to restrict web-based module administration, is not enforced in the REST API upload path, allowing the restriction to be bypassed.

The '/openmrs/moduleResources/{moduleid}' endpoint is susceptible to a path traversal attack. This occurs because the `ModuleResourcesServlet` uses the `getFile()` function to construct a filesystem path from user-supplied input without performing path boundary validation or using the `normalize()` method to ensure the result remains within the intended directory. Since this endpoint provides static resources for the login page, it bypasses authentication filters, allowing unauthenticated attackers to read arbitrary files from the server filesystem, such as '/etc/passwd' and configuration files containing database credentials. Successful exploitation depends on the server running Apache Tomcat versions prior to 8.5.31, as later versions (8.5.31+ and 9.0.10+) mitigate the `..;` path parameter bypass at the container level.

An issue in the '/a/file/upload' endpoint allows authenticated attackers with file upload permissions to perform path traversal and write arbitrary files with whitelisted suffixes to any location on the filesystem when chunked upload is enabled. This is possible via the `fileMd5` parameter.

A path traversal issue in the '/content/images/add' endpoint allows attackers to write arbitrary files to any writable path using a crafted POST request. Path traversal is a technique that allows an attacker to access or manipulate files and directories outside the intended folder on a server.

A stored cross-site scripting (XSS) issue exists in the '/msg/msgInner/save' endpoint. This allows attackers to execute arbitrary web scripts or HTML by injecting crafted input into the `msgContent` parameter. Cross-site scripting is a flaw where malicious scripts are injected into otherwise trusted websites.

An issue in the '/a/file/upload' endpoint allows authenticated attackers with file upload permissions to perform path traversal. By manipulating the `fileEntityId` parameter, an attacker can write arbitrary files with whitelisted suffixes to arbitrary locations on the filesystem. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

An XML external entity (XXE) flaw in the "/designer/loadReport" endpoint allows authenticated attackers to execute arbitrary code by injecting a crafted payload. XXE is a type of attack where an application processes XML input containing a reference to an external entity, which can lead to unauthorized data access or remote code execution.

Multiple authenticated cross-site scripting (XSS) issues exist in the `XssHttpServletRequestWrapper` class. These allow attackers to execute arbitrary web scripts or HTML by injecting crafted payloads into the `getInputStream()` and `getReader()` functions.

A Server-Side Request Forgery (SSRF) exists in the "/plugins/-/install-from-uri" endpoint. This allows authenticated attackers to scan internal resources by sending a crafted GET request. SSRF is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

An authenticated attacker can scan internal resources by sending a crafted GET request to the '/themes/-/install-from-uri' endpoint. This is caused by a Server-Side Request Forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location.

A Server-Side Request Forgery (SSRF) exists in the '/themes/{name}/upgrade-from-uri' endpoint. This allows authenticated attackers to scan internal resources by sending a crafted GET request. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

A Server-Side Request Forgery (SSRF) exists in the '/plugins/{name}/upgrade-from-uri' endpoint. This allows authenticated attackers to scan internal resources by sending a crafted GET request. SSRF is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

A Server-Side Request Forgery (SSRF) exists in the '/ureport/datasource/testConnection' endpoint. This allows authenticated attackers to scan internal resources by sending a crafted GET request. SSRF is a flaw where an attacker can force a server-side application to make requests to an unintended location.

The software contains a stored cross-site scripting (XSS) issue in the `/system/menu/edit` API endpoint. The existing XSS filter can be bypassed, allowing for exploitation. Because the menu is shared across all users, a user with menu modification permissions can impact all users. The vulnerable parameter is not specified.

The software is susceptible to a stored Cross Site Scripting (XSS) issue. The vulnerability exists through the `/msg/add` API endpoint. An attacker could potentially inject malicious scripts that are then stored and executed when other users access the affected functionality. The vulnerable parameter is not specified.

The software is susceptible to a stored cross-site scripting (XSS) issue. Attackers can exploit this by uploading PDF files containing malicious XSS payloads. These files are then accessible through static URLs, potentially exposing them to all users.

Jeecgboot versions 3.8.2 and earlier are susceptible to a path traversal issue. The `/sys/comment/addFile` API endpoint allows attackers to upload files with system-whitelisted extensions to the `/opt` directory, bypassing the intended upload location of `/opt/upFiles` configured for the web server. The `addFile` function is involved in this issue.

Jeecgboot versions 3.8.2 and earlier are susceptible to a path traversal issue. This allows attackers to upload files with system-whitelisted extensions to the `/opt` directory, bypassing the intended upload location of `/opt/upFiles` configured by the web server.