Arthur Chan

An authenticated principal with no authorization grants can force a broker to read and return the contents of a file or an environment variable from the broker host. This occurs because `IncrementalAlterConfigs` or `AlterConfigs` requests targeting a BROKER resource undergo configuration validation before authorization checks are applied. During this process, the system resolves configuration variables using a `ConfigProvider` specified in the request, bypassing the established allowlist. This allows the instantiation of arbitrary providers, such as `FileConfigProvider` or `EnvVarConfigProvider`, which can then expose sensitive data like credentials or keystores through type-validation errors. The impact is limited to files and environment variables accessible to the broker process's operating-system permissions.

A client can send a WebSocket frame containing an unknown opcode and an excessively large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass standard maximum frame size checks, leading the system to attempt a large memory allocation before the opcode is validated. This process can exhaust the JVM heap, potentially causing a denial of service.

An attacker connecting to an open Erlang TCP port using the inet driver with `{packet,4}` mode can trigger a signed overflow due to an incorrect packet length calculation. This allows the receive buffer to overflow into the VM allocator area and beyond by up to 2 GB, which typically corrupts the allocator metadata footer and subsequent blocks, leading to a BEAM VM crash. Achieving Remote Code Execution through this method is considered extremely unfeasible.

A heap buffer overflow occurs during the compilation of cell formulas when opening a spreadsheet. This issue is triggered by very long formulas containing numerous opening tokens. The array used to track nesting depth is allocated with one element too few for the worst-case scenario, causing the formula to write one element beyond the array boundary.

A stack buffer overflow occurs when importing presentations in the legacy binary PPT format. The issue arises during the import of a colour-replacement record where two fixed-size colour tables are filled from the file. Because the write position is not reset between the two passes over the record, a file with combined colour counts exceeding the table size writes past the end of the tables on the stack.

A heap buffer overflow occurs during the import of tracked changes from a spreadsheet document. This happens when a document reuses the same change identifier for two different types of changes, causing the importer to treat a change object as a larger type and write data beyond the allocated memory boundary.

Private key exposure occurs when the server inadvertently reveals Elliptic Curve (EC) private keys through the public '/token keys' endpoint. While this endpoint is intended to provide public key material for JSON Web Token (JWT) verification, it incorrectly exposes private key components for EC keys. This issue specifically affects deployments using EC keys for JWT token signing and does not impact RSA key configurations.