Euriconicacio

An improper authorization issue allows realm administrators to access and modify global resources by calling admin endpoints that lack super administrator checks. An attacker can use the '/configuration/manager' endpoint to change the global `keycloakUrl` variable, enabling the redirection of console authentication for other realms to facilitate credential phishing. Additionally, this allows for CSS injection, replacement of map tiles, and deletion of logs.

An authorization bypass exists where namespace administrators can escape namespace confinement. This occurs because the cleanup controller initializes its context loader with a nil policy, causing security guards to read an empty namespace and fail to restrict access. An attacker can create a namespaced `CleanupPolicy` containing `apiCall` or `globalReference` context entries. This allows the attacker to use the cleanup controller's ServiceAccount to read Secrets across different namespaces and modify `validatingwebhookconfigurations`.

A path traversal issue exists in the serve webdav functionality. Unauthenticated attackers can write files outside the served root directory by sending an unvalidated `..` path component. This is achieved by sending an MKCOL /.. request to plant a Virtual File System (VFS) node, followed by PUT, MOVE, COPY, or MKCOL requests to create, overwrite, or delete files belonging to other tenants.

When a proxy entry is configured to forward WebSockets, the server forwards non-HMR (Hot Module Replacement) WebSocket upgrade requests to the proxy target without validating the Host or Origin headers. This bypasses the allowedHosts protection. Consequently, a malicious web page visited by a developer can establish a cross-origin WebSocket connection through the development server to read from and write to the proxied backend, even if the server is bound to the loopback address.

An authorization flaw exists in the 'GET /1.0/operations/{uuid}' endpoint. This allows clients restricted to a specific project to access operation details from other projects. An attacker with a restricted certificate and a known `uuid` can retrieve sensitive information, including command lines, environment secrets, websocket secrets, and trust enrolment tokens.

An authorization flaw exists in the 'SubDomains.delete' API endpoint. Authenticated customers can exploit this by providing a main domain id to delete main domains provisioned by resellers. This allows attackers to bypass web UI restrictions to remove domains and orphan vhost, DNS, and subdomain records. Additionally, this can be used to manipulate the `subdomains used` variable to a value below zero, granting unauthorized extra subdomain allowance.

A symlink following issue exists in the `Statistics::makeChownWithNewStats()` function. Authenticated customers can exploit this by replacing the goaccess statistics directory in their document root with a symbolic link. When the root-run traffic cron executes, it triggers a `chown -R` command that can transfer ownership of arbitrary host directories to the user, leading to root escalation.

An authorization bypass exists in the 'Admins.get' API endpoint. This issue occurs due to identifier confusion, allowing resellers to access any administrator record. By providing their own `loginname` alongside another administrator's numeric `id`, an attacker can retrieve sensitive information, including contact emails, IP allow-lists, resource limits, notes, and login history.

An incorrect authorization issue exists where delegated administrators without the `editnews` permission can modify news items. This occurs because the endpoint "PUT /admin/api/news/update" incorrectly verifies the `NEWS DELETE` permission instead of `NEWS EDIT`. Users possessing `addnews` and `delnews` permissions can retrieve the `update-news` CSRF token from their cookies to alter the header, body, author, link, and active status of any news item displayed on the public front page.

An authorization flaw in the admin dashboard allows authenticated users who lack administrative privileges to access restricted information. By requesting the '/admin/index.php/' endpoint, an attacker with any active account can view unpublished FAQ questions, administrative edit URLs, recent user identities, and site statistics.

An authorization bypass allows authenticated users to export lists even when export restrictions are active. This occurs because the `groups roles export` check in the `modules/groups-roles/lists show.php` file fails to account for the `pdfl` mode. Consequently, users with list view permissions can download member lists as PDF files by requesting the `mode` parameter with the value `pdfl`.

Broken access control in the 'modules/inventory/inventory data.php' endpoint allows authenticated users to bypass the `inventory module enabled` restriction. An attacker with valid credentials can request the DataTables JSON feed to retrieve all inventory items and keeper names, regardless of whether the module is disabled.

The Agent dispatcher performs a JSON-based deep clone of constructor options before forwarding them to per-origin pools. Since JSON cannot represent functions, any `tls` option containing a `checkServerIdentity` callback is silently dropped. This allows a TLS peer to be accepted if it passes default hostname and chain checks, even if a custom `checkServerIdentity` was intended to reject it. This issue affects the default paths used by `request`, `fetch`, and `setGlobalDispatcher`, as well as the direct and no-proxy routes of `EnvHttpProxyAgent`. Only applications using function-valued `tls` options for tasks like certificate or public-key pinning are at risk.

An improper access revocation issue allows removed collaborators to continue receiving project data via webhooks they previously created. This results in former collaborators receiving task titles and descriptions, including information generated after their access was revoked.

The `Address6.isLinkLocal()` method in `src/ipv6.ts` incorrectly recognizes only the `fe80::/64` range instead of the full `fe80::/10` IPv6 link-local range. This creates an inconsistency where the same address may be identified as link-local by `getType()` and `getScope()` but return `false` when checked via `isLinkLocal()`. An attacker can use an address within the `fe80::/10` range to bypass trust-boundary checks, such as filters designed to prevent Server-Side Request Forgery (SSRF). SSRF is an attack where a user-supplied address tricks a server into making requests to internal destinations that are otherwise inaccessible. A successful bypass allows a request to reach an on-link host, such as a neighboring machine or a router on the server's own network segment.

The SFTP front end contains a volume restriction bypass that allows authenticated users to create, remove, and truncate arbitrary paths outside permitted volume boundaries. This occurs because the ` mkdir`, ` rmdir`, and ` chattr` handlers construct destination paths using `vfs.get()`, `vn.canonical()`, and `os.path.join()` without invoking the `chk ap` access check. Consequently, attackers can traverse symlinks to leave a volume's top directory and perform unauthorized file operations via SSH FXP SETSTAT operations on paths outside their authorized volumes.

On Windows, the `TemplateLookup.get template()` function in `mako/lookup.py` resolves template URIs using `posixpath`, whereas `Template. init ()` in `mako/template.py` validates them using `os.path` (which utilizes `ntpath`). A URI starting with a drive designator allows `ntpath` to absorb traversal segments before the leading dot-dot check, enabling `posixpath` resolution to escape the configured template directory. This can lead to the disclosure of process-readable files on the same volume. Additionally, if a targeted file contains Mako template syntax, it may be parsed and executed as a template. This occurs when an application passes attacker-controlled template names or include paths, which can be delivered via query strings, form or JSON bodies, route parameters, or dynamic include expressions.

An authorization bypass exists in the `ListArchivedWorkflows` function. The issue occurs when the `metadata.namespace` field selector utilizes the NotEquals operator, causing a failure to apply cluster-scoped access reviews. Users with namespace-scoped list permissions can employ a negated namespace field selector to retrieve archived workflows from other namespaces, potentially exposing annotations, parameter values, and spec arguments.

multer is a Node.js middleware for handling multipart/form-data uploads. When a request using disk storage is aborted during the upload process, file writes that finish after the abort cleanup has executed are not deleted. This results in orphaned files remaining on the disk. A remote unauthenticated attacker can exploit this by repeatedly starting and aborting uploads to fill the disk space, leading to a denial of service.

The `IsInternalIP` deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix. This allows server-side request forgery (SSRF), a technique where an attacker induces a server to make requests to an unintended location. Attackers can provide hostnames that resolve to these addresses within message content to access the link check API and proxy endpoint, enabling access to internal resources.