Aurelien Thirion

The Onion module contains a flaw in its URL extraction logic due to a performance shortcut. The system validates .onion targets using only a length check of exactly 69 characters and a suffix check for ".onion", omitting proper hostname parsing or onion-domain validation. An unauthenticated attacker can embed a crafted URL containing an IP address or a non-onion hostname with a path ending in ".onion" into content crawled by the framework. This allows the injection of arbitrary non-onion targets into the crawler's task queue, potentially directing the framework toward unintended network resources and compromising the integrity of target selection.

A stored cross-site scripting (XSS) issue exists in two Jinja2 templates used to render popovers for matched, tracked, or tagged content: `var/www/templates/chats explorer/block message.html` and `var/www/templates/objects/item/show item.html`. Dynamic values such as `icon color`, `icon style`, `icon glyph`, `subtype`, `identifier`, `name`, `description`, and `matched value` are inserted into the `data-content` HTML attribute of Bootstrap popover elements without proper output encoding. Since these popovers use `data-html="true"`, the browser interprets the content as HTML. An authenticated attacker capable of influencing this content can inject arbitrary HTML or JavaScript, which executes in the session of a victim viewing the popover, potentially leading to data exfiltration or unauthorized actions using the victim's privileges.

The username timeline feature is susceptible to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst hovers over a timeline entry, the application renders the stored username into the Document Object Model (DOM) using the D3 `html()` method in the tooltip. Because the `d.obj` variable is interpolated directly into an HTML string without sanitization, a crafted username containing HTML event handlers can execute arbitrary JavaScript in the analyst's browser. This issue resides in the client-side JavaScript file `var/www/static/js/d3/timeline basic.js`. Successful exploitation may result in session hijacking, data exfiltration, or unauthorized actions within the authenticated session.

The tag selector component located at `var/www/static/js/tags.js` is susceptible to stored cross-site scripting (XSS). An authenticated user with permissions to create custom tags can embed HTML payloads containing JavaScript event handlers within a tag name. The issue occurs because the ` renderComboItems` function and the selected-tag rendering logic pass the `displayField` value directly to the jQuery `html` property, which inserts the string as raw HTML into the Document Object Model (DOM) instead of treating it as plain text. This allows arbitrary JavaScript execution in the browser of any authenticated user who views a page rendering the malicious tag, potentially leading to session hijacking, unauthorized data access, or form manipulation.

The crawler splash domain page `showDomain.html` is susceptible to stored cross-site script injection (XSS). This occurs because user-supplied data from imported crawler captures—specifically `item IDs`, `URLs`, and screenshot file paths—is interpolated directly into inline JavaScript contexts within the HTML template. The issue manifests in an `onclick` attribute that embeds raw screenshot and URL values into a JavaScript function call, as well as an inline script block that assigns a screenshot value to a JavaScript variable without proper escaping. An attacker with a user-role API client can import malicious crawler captures containing JavaScript payloads. When a user views the affected domain page, the script executes in their browser context, which may lead to session hijacking, data exfiltration, or unauthorized actions.

A server-side request forgery (SSRF) issue exists in the crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling due to insufficient validation of the destination host. This allows the crawler to make direct HTTP(S) requests to restricted addresses, such as loopback addresses, RFC1918 private networks, link-local addresses, and cloud metadata services like 169.254.169.254. Manual crawler tasks bypass the domain blacklist because they are assigned a non-zero priority, and IP literals are fetched directly instead of using a proxy. An attacker can use the server as a network pivot to access internal services. Since the crawler interface provides access to the resulting HTML, screenshots, and HAR data, the SSRF is non-blind, potentially leading to the disclosure of sensitive internal data, service information, or cloud instance credentials.

A stored cross-site scripting issue exists in the translation controls for chat messages and forum posts. The system inserts message and post identifiers directly into inline JavaScript `onclick` handlers within the functions `translateMessageToPreferredLanguage()` and `translatePostToPreferredLanguage()`. While these values are HTML-template escaped, they are not safely encoded for use as JavaScript string literals inside an HTML attribute. An attacker can use a specially crafted identifier containing quotation marks or escape characters to terminate the string argument and inject arbitrary JavaScript. Since these values are stored, the malicious code executes in the victim's browser under the security origin of the AIL instance when they click the Translate to preferred language button.

A reflected cross-site scripting issue exists in the '/tag/add tags' endpoint. When a tag operation fails, the application returns the error value as an HTML response via the `str(res[0])` function without proper output encoding. An attacker can exploit this by tricking an authenticated user into clicking a crafted link, allowing arbitrary JavaScript to execute in the victim's browser. This could enable the attacker to perform actions using the victim's session, access sensitive information, or modify data. The attack requires user interaction and does not necessarily require the attacker to have an account.

A stored cross-site scripting issue exists in the crawler domain view. The application embeds crawled URLs directly into a JavaScript onclick handler used to display stored screenshots without proper encoding. An attacker can record a specially crafted URL in the crawler history to inject JavaScript syntax. When an authenticated analyst clicks the screenshot icon for the malicious URL, the script executes within the analyst's browser session. This could allow the attacker to access session information, modify content, or perform actions using the analyst's privileges. Exploitation requires the victim to interact with the affected screenshot entry.

PlaywrightCapture stored configuration and runtime data as mutable class-level variables instead of instance-level variables. This allows multiple Capture objects within the same Python process to share state, including HTTP headers, cookies, browser storage, HTTP credentials, proxy configuration, user-agent settings, geolocation information, and captured request data. In concurrent or multi-user deployments, data from one capture can persist and be reused by others, potentially leading to the disclosure of authentication cookies, credentials, or browser storage. This may also allow requests to be executed using another capture's authentication context or proxy configuration, enabling unauthorized access to remote resources.

A path traversal issue exists in the PDF object handling. The `PDF.get filepath()` function constructs a file path by joining the configured PDF storage directory with a path derived from a PDF object identifier without verifying if the resolved path remains within the intended `PDF FOLDER` directory. An authenticated attacker could use relative traversal sequences or absolute path components via a crafted identifier to open files outside the storage directory, potentially leading to the disclosure of sensitive local data, credentials, or application configurations readable by the AIL process.

AIL failed to restrict repeated unsuccessful attempts to verify a two-factor authentication (OTP) code. An attacker who successfully completed the password authentication stage could submit an unlimited number of OTP guesses. This allows for brute-force guessing of a valid code to bypass the second authentication factor and gain unauthorized account access.

A path traversal issue allows an authenticated user to supply crafted object identifiers through the investigation workflow, causing file paths to resolve outside the intended image, favicon, or screenshot storage directories. This occurs because user-controlled path components are joined with application storage paths without verifying that the resolved path remains within the expected directory. Consequently, an attacker can download and read arbitrary files accessible to the AIL process via the affected download functionality, which may include these files in a generated archive.

A path traversal issue exists in the '/objects/item/diff' endpoint. The endpoint accepts item identifiers via the `s1` and `s2` query parameters and attempts to retrieve and compare item contents without verifying that the referenced items are valid AIL objects. An authenticated user can use path traversal sequences in these parameters to read gzip-compressed files accessible to the AIL process, potentially leading to the unauthorized disclosure of local file contents compatible with the expected gzip format.