Fuzzztf

Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server.

An unbounded recursion issue exists in the Apple MDM enrollment property list parsing. Unauthenticated attackers can crash the server by sending a crafted binary plist payload of approximately 150 bytes to the enrollment endpoints. This action triggers exponential allocation or infinite recursion, leading to the exhaustion of CPU and memory resources.

An issue exists where unauthenticated attackers can cause a denial of service by exhausting server memory. This is achieved by sending small, highly compressed request bodies using the `Content-Encoding: gzip` header to unauthenticated endpoints. During the decoding process, these requests expand significantly, leading to a crash of the entire instance.

A SQL injection exists in the Okta conditional access integration. An attacker controlling a single enrolled host can provide a value via the host agent that is used in a database query without proper parameterization. This allows the attacker to read or modify arbitrary data in the database, including stored session tokens. If session tokens are disclosed, they can be replayed to obtain global administrator privileges, potentially leading to remote code execution on all enrolled hosts through the execution of scripts.

The target search endpoint `POST /api/latest/fleet/targets` fails to sanitize data for users with Observer, Observer+, or Technician roles. This allows these users to retrieve unmasked team enroll secrets and full team configurations, including credential-bearing agent options such as AWS secret access keys, proxy passwords, or session tokens. While other team-facing endpoints mask these fields, this specific endpoint does not, potentially allowing unauthorized hosts to be enrolled into a team or the theft of sensitive credentials.

Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof their apparent IP address and bypass per-IP rate limiting controls. The software determines a client’s public IP address using HTTP headers such as "X-Forwarded-For", "X-Real-IP", and "True-Client-IP", which were trusted without validation. An attacker could supply arbitrary values in these headers, causing the system to treat each request as originating from a different IP address, thereby increasing the effectiveness of brute-force or password-spraying attempts against authentication endpoints.

A denial-of-service (DoS) issue exists in the gRPC Launcher "PublishLogs" endpoint. Certain unexpected input values are not handled gracefully, which can cause the server process to terminate while processing an authenticated request from an enrolled Launcher host. An authenticated attacker with access to any enrolled Launcher node key can cause a complete denial of service by sending a single gRPC request to the "PublishLogs" endpoint. This issue impacts availability only, with no exposure of sensitive data, authentication bypass, privilege escalation, or integrity impact.

An issue in the IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. The software extracts client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating if they originate from a trusted proxy. Since the extracted IP serves as the key for rate limiting and IP ban decisions, an attacker can rotate these header values to make each request appear as if it comes from a different client. This enables unrestricted brute-force or credential stuffing attacks against sensitive endpoints, such as the login API. This primarily affects instances exposed to the public internet without a reverse proxy that overwrites forwarded-IP headers.

Fleet, an open source device management software, contains an issue in its Windows MDM command processing. A malicious enrolled device can access MDM commands intended for other devices. This could expose sensitive configuration data, including WiFi credentials, VPN secrets, and certificate payloads, across the entire Windows fleet.

Fleet’s password management logic had a flaw that allowed previously issued password reset tokens to remain valid even after a user changed their password. This meant a stale token could be reused to reset the account password after a defensive password change. Exploitation requires prior compromise of a password reset token and is limited by the token’s 24-hour expiration period. The issue does not allow discovery of reset tokens, does not bypass authentication on its own, and does not affect accounts without an existing valid reset token.

Fleet, an open source device management software, has multiple unauthenticated HTTP endpoints that do not enforce a size limit when reading request bodies. An unauthenticated attacker can exploit this by sending large or repeated HTTP payloads, leading to excessive memory allocation and a denial-of-service (DoS) condition. The issue impacts availability only, with no exposure of sensitive data, authentication bypass, privilege escalation, or integrity impact.

Fleet, an open-source device management software, contains a flaw in its gRPC Launcher endpoint. An authenticated host can exploit this to cause a denial-of-service condition, leading to the termination of the entire Fleet server process. This disruption impacts all connected hosts, Mobile Device Management (MDM) enrollments, and API consumers by sending an unexpected log type value to the `gRPC Launcher` endpoint.

Fleet, an open source device management software, had a flaw in how user invitations were handled. Specifically, the email address entered when accepting an invitation wasn’t checked against the email address linked to the original invitation. This allowed an attacker with a valid invite token to create an account using any email address and gain the role assigned to the invitation, potentially including global administrator privileges.

Fleet is open source device management software. A SQL injection issue exists due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause. This allows authenticated users to inject arbitrary SQL expressions via the `order key` query parameter. An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query. Although the injection occurs in an `ORDER BY` context, it is sufficient to enable blind SQL injection techniques that can disclose database information through conditional expressions that affect result ordering. Crafted expressions may also cause excessive computation or query failures, potentially leading to degraded performance or denial of service. The vulnerable parameter is `order key`.