Diabl0-Sec

**Name of the Vulnerable Software and Affected Versions** cpp-httplib versions prior to 0.37.0 **Description** The software uses `std::regex` (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. A crafted filename* parameter can cause uncontrolled stack growth due to deep recursion in the regex engine, leading to a stack overflow and server process crash. The issue occurs when processing HTTP POST requests with a specially designed `filename*` parameter within the Content-Disposition header. **Recommendations** Update to version 0.37.0 or later.

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.23.7 Description: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another user in the same organization by directly invoking the `user.one` endpoint. The response discloses personally-identifiable information (PII) such as `email address`, `role`, `two-factor status`, `organization ID`, and various `account flags`. Recommendations: For versions prior to 0.23.7, update to version 0.23.7 to resolve the issue. As a temporary workaround, consider restricting access to the `user.one` endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.23.7 Description: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access, such as `/etc/passwd`, application source, environment variable files containing credentials and secrets. This may lead to full compromise of other services or lateral movement. Recommendations: For versions prior to 0.23.7, update to version 0.23.7 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and environment variables to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.23.7 Description: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure `docker.getContainersByAppNameMatch` interpolates the attacker-supplied `appName` value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. Recommendations: For versions prior to 0.23.7, update to version 0.23.7 to fix the issue. As a temporary workaround, consider restricting access to the `docker.getContainersByAppNameMatch` procedure to prevent command injection attacks.

**Name of the Vulnerable Software and Affected Versions** OpenZiti versions prior to 3.7.1 **Description** The issue concerns an endpoint, "/api/upload", on the admin panel that can be accessed without authentication. This endpoint allows file uploads via HTTP POST, which are then stored on the node and accessible via URL. If a malicious file containing code is uploaded and accessed, it can lead to a stored cross-site scripting attack when executed within the user's browser context. The function is no longer necessary and has been disabled as the ziti-console transitions from a node server application to a single-page application. **Recommendations** For versions prior to 3.7.1, update to version 3.7.1 to resolve the issue. As a temporary workaround, consider disabling access to the "/api/upload" endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenZiti versions prior to 3.7.1 **Description** The issue concerns an endpoint on the admin panel that can be accessed without authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller, which can lead to a Server-Side Request Forgery (SSRF) vulnerability. The SSRF vulnerability allows an attacker to perform server-side requests, potentially exploiting the identity of the node to gain additional permissions. **Recommendations** For versions prior to 3.7.1, update to version 3.7.1 to fix the vulnerability, as it moves the request to the external controller from the server side to the client side, eliminating the potential for SSRF exploitation.