Evidentobscurity

An issue allows unauthenticated attackers to induce the server to send HTTP requests by registering an OAuth2 client with an unvalidated `jwks uri`. This can be triggered via the token introspection endpoint using an unsigned `client assertion`, enabling the probing of internal services and access to cloud metadata endpoints. Server-side request forgery is a flaw where a server is tricked into making requests to an unintended location.

A stored Cross-Site Scripting (XSS) issue exists in the contact detail view. HTML-type custom contact fields are rendered without output sanitization, allowing a user or integration to store a script payload via contact editing, the contact API, or form submissions mapped to the field. When an administrator or another user views the affected contact's detail page, the script executes in their browser session. This can lead to unauthorized administrative actions, including the creation of new administrator accounts, modification of system configurations, or unauthorized access to campaign and contact data.

The SSRF guard in the CMS resolves hosts using an IPv4-only function and fails to inspect IPv6 addresses. Consequently, any host lacking an A record bypasses the private-range check. An authenticated user with admin-panel privileges (role `site admin` or higher) can exploit the Editor oEmbed proxy to fetch an attacker-supplied URL server-side. By using an IPv6 literal or a domain with only an AAAA record, the user can read internal-only services and cloud metadata, such as IAM credentials. SSRF (Server-Side Request Forgery) is a flaw where a server is tricked into making requests to an unintended location.

The HTML sanitizer fails to strip event-handler attributes when a tag contains a greater-than character within a quoted attribute value. This allows a low-privilege content author, such as those with the author or contributor role, to store a malicious payload in post or product content. When a visitor or administrator views or previews the content, the payload executes JavaScript in their browser, potentially leading to the takeover of administrator accounts.

A flawed central path sanitizer allows an authenticated admin-panel user with backup access (such as the `site admin` role or higher) to read and delete arbitrary files on the server. This can lead to the recovery of database credentials from `config/db.php`, the reading of sensitive host files like `/etc/passwd`, or the deletion of `config/db.php` to force the site into install mode for a complete system takeover.

Stored cross-site scripting occurs when a user with customer privileges uploads an SSL certificate. The Certificates API `add()` and `update()` methods use `openssl x509 parse()` to process the certificate and store the issuer organization `issuer['O']` value without sanitization. Because the table-listing renderer uses the Twig `raw` filter, which disables HTML auto-escaping, the malicious value executes as a script when an administrator or reseller views the SSL certificates section. This allows a privilege escalation from a customer to an administrator, potentially leading to full account takeover. Since administrators control webserver, DNS, and PHP configurations via a root-level cron job, this can be further escalated to remote command execution as root on the server.

An insecure default in the library allows an unauthenticated attacker to perform Server-Side Request Forgery (SSRF). When an application validates an untrusted X.509 certificate, the `X509::validateSignature()` function reads a URL from the certificate's Authority Information Access (AIA) extension and establishes a connection to it. Because URL fetching is enabled by default without destination blocking, an attacker can control the host, port, and path of the connection to reach internal hosts and services, such as the loopback address 127.0.0.1 or cloud metadata addresses like 169.254.169.254.