August829

Remote unauthenticated clients can perform SNI hostname spoofing through JNI NewStringUTF decoding. By sending overlong encodings, such as 0xC0 0x80, within the `server name` of the ClientHello, attackers can manipulate SNI-based certificate selection, access decisions, and logging. Server Name Indication (SNI) is an extension of the TLS protocol that allows a client to specify the hostname it is attempting to connect to during the handshake process.

A heap buffer overflow occurs in the `tcn write to bytebuffer` BIO callback due to a failure to wrap the non-application ring buffer write index. Remote TLS peers can send handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy (a memory copy operation that writes data beyond the allocated buffer boundary), which results in a crash of the JVM process.

When built against OpenSSL 3.x, a use-after-free issue occurs during session ticket key rotation. This happens when remote clients perform TLS handshakes while the `setSessionTicketKeys0` function frees the shared key array, leading OpenSSL to read freed HMAC keys. This can result in the corruption of ticket processing or a system crash. The issue is located within the `ssl tlsext ticket key cb` function.

[Content removed]

A stored cross-site scripting issue exists in the monitor dashboard. The application renders crawl URLs and error messages using `innerHTML` without proper escaping. This allows an attacker to submit a crafted crawl request containing malicious markup, which then executes in the browser of an operator viewing the dashboard.

Multiple security issues affect the Crawl4AI Docker API server. The software is susceptible to Server-Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location, through the '/crawl', '/crawl/stream', '/md', '/llm', '/crawl/job', and '/llm/job' endpoints. Attackers can bypass internal-address blocklists using IPv6-mapped IPv4 addresses to access internal services, Docker networks, and cloud metadata endpoints. Additionally, the '/screenshot' and '/pdf' endpoints allow arbitrary file writes via the `output path` parameter, enabling the overwriting of server files. The '/execute js' endpoint allows arbitrary JavaScript execution in the server's browser. Other issues include an authentication bypass on monitor endpoints, stored Cross-Site Scripting (XSS) in the monitor dashboard, and a hardcoded JWT secret key that allows the forgery of authentication tokens.

The Docker API server contains an authentication bypass issue caused by a hardcoded default JWT (JSON Web Token) signing key. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. Because the secret used to sign these tokens is publicly known, a remote attacker can forge valid tokens for any user to bypass authentication and gain full access to protected functionality.

The ` safe eval expression()` function in the computed fields feature uses an AST (Abstract Syntax Tree) validator that only blocks attributes starting with an underscore. Because Python generator and frame object attributes such as `gi frame`, `f back`, and `f builtins` do not start with an underscore, they can be used to escape the sandbox and achieve arbitrary code execution. An unauthenticated attacker can trigger this by sending a 'POST /crawl' request with a crafted `JsonCssExtractionStrategy` schema containing a malicious computed field expression. This allows the attacker to access the frame chain, reach `f builtins` to import the `os` module, and execute arbitrary system commands inside the Docker container, potentially leading to file system access and secret exfiltration.

A flaw in the baggage propagation implementation within `opentelemetry-api` and `opentelemetry-extension-trace-propagators` allows for unbounded memory allocation and CPU consumption when parsing oversized baggage. This occurs because the `W3CBaggagePropagator`, `JaegerPropagator`, and `OtTracePropator` did not enforce limits on the total size or entry count of the `baggage` header, iterating through values regardless of length. Since baggage is automatically re-injected into outgoing requests, the impact can spread to downstream services. The risk is increased in environments where transport-layer limits are absent, such as compromised internal services using non-HTTP or custom transports.

The base directory `spring.cloud.config.server.git.basedir` used by the Spring Cloud Config Server to clone Git repositories is susceptible to time-of-check-time-of-use (TOCTOU) attacks. TOCTOU is a race condition where a system checks the state of a resource and then performs an action based on that state, but the resource is modified between the check and the action.

The `spring-cloud-config-server` module allows applications to serve arbitrary text and binary files. A malicious user can send a request using a specially crafted URL to perform a directory traversal attack, which is a technique used to access files and directories stored outside the intended folder. Additionally, a GCP secret leak has been identified.

Various `FilterExpressionConverter` implementations fail to properly escape keys and values when translating filter expression objects into specific vector store query languages. This improper escaping allows for query injection, which can enable attackers to alter vector store queries, potentially leading to data exposure and tampering.

When configured to use an SSL bundle, the Elasticsearch auto-configuration fails to perform hostname verification during the connection to the Elasticsearch server. Hostname verification is a security process that ensures the server's certificate matches its actual hostname to prevent man-in-the-middle attacks.

The library is susceptible to a Prototype Pollution Gadget attack. This occurs because the `validateStatus` configuration property utilizes the mergeDirectKeys merge strategy, which employs the JavaScript in operator that traverses the prototype chain. If `Object.prototype.validateStatus` is polluted with `() => true`, all HTTP error responses (such as 401, 403, and 500) are treated as successful responses, effectively bypassing application-level authentication and error handling.

Axios is a promise based HTTP client for the browser and Node.js. The library is susceptible to a Prototype Pollution Gadget attack. This occurs because the default transformResponse function calls JSON.parse(data, this.parseReviver), where `this` is the merged config object. Since `parseReviver` is not present in defaults, not validated by assertOptions, and lacks constraints, a polluted `Object.prototype.parseReviver` function is executed for every key-value pair in every JSON response. This allows an attacker to selectively modify individual values in JSON API responses, which can lead to privilege escalation, balance manipulation, and authorization bypass.

The `encode()` function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (`charMap`) that reverses the safe percent-encoding of null bytes. While `encodeURIComponent('x00')` produces the safe sequence %00, the `charMap` entry '%00': 'x00' converts it back to a raw null byte. The primary impact is limited as the standard request flow is not affected.

The XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the `withXSRFToken` config property. When this property is set to any truthy non-boolean value, the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets, including cross-origin servers controlled by an attacker.

The password change endpoint is susceptible to NoSQL injection, a technique where MongoDB query operators are injected into a database query. An authenticated attacker can use this to bypass the verification of the old password. This allows a user with a low-privileged session to change account passwords without knowing the current one, potentially leading to full account takeover and persistence.

The password-based login endpoint uses TypeScript type assertion without runtime validation. This allows an unauthenticated attacker to use a MongoDB query operator object, such as `{"$ne": ""}`, in the `password` field. This NoSQL injection—a technique where an attacker uses database-specific syntax to manipulate queries—bypasses authentication checks, enabling unauthorized access to any user account, including the root administrator.

FastGPT is an AI Agent building platform. The MCP (Model Context Protocol) tools endpoints `/api/core/app/mcpTools/getTools` and `/api/core/app/mcpTools/runTool` accept a user-supplied URL parameter and make server-side HTTP requests to it without validating whether the URL points to an internal or private network address. The application has a dedicated `isInternalAddress()` function for SSRF protection, but this function is not called by the MCP tools endpoints. An authenticated attacker can use these endpoints to scan internal networks, access cloud metadata services, and interact with internal services such as MongoDB and Redis. The vulnerable parameters are the URL parameters used in the `/api/core/app/mcpTools/getTools` and `/api/core/app/mcpTools/runTool` API endpoints.