Geo-Chen

The `userSessionLogout()` function in `src/RestControllers/AuthorizationController.php` uses `decodeToken()` to process an `id token hint` without verifying its signature. If the referenced trusted session is missing, the application redirects to the `post logout redirect uri` provided by the caller before validating it against the registered client redirect URIs. This allows an unauthenticated attacker to create a logout link that invalidates a user session and redirects the user to an arbitrary external site, facilitating phishing attacks. This issue is accessible when the OpenEMR REST API is enabled.

The `generatePdf` entry point in the `modules/AOS PDF Templates/generatePdf.php` file loads arbitrary records using the `BeanFactory::getBean()` function without verifying the requesting user's access permissions. This allows any authenticated user to bypass Access Control List (ACL) roles and read sensitive information from records they are not authorized to access, including financial, contact, deal, and custom-field data.

Improper authorization checks allow authenticated employees to bypass permissions and view expense advance details of other employees. This is achieved by querying the Expense Claim Advances API, which exposes sensitive financial information.

The application fails to implement a route-level authentication check in the audit router. Specifically, the endpoint '/api/v2/audit/timeline/{id}' does not require the `auth.get current active user` dependency. This allows an unauthenticated network attacker to use empty, partial, or wildcard paths to query `TimelineLog` records. Exposed data includes the `actor`, `target id`, `action`, and `details` fields, which may contain analyst usernames, object identifiers, and historical data of threat-intelligence objects.

Improper neutralization of quoting syntax in SQL identifier construction within the Apache Iceberg write component allows an authenticated remote user with permissions to modify AWS Glue Data Catalog metadata to perform unauthorized actions. By using a crafted column name, the user can read any table accessible to a more privileged principal and write to the table that the privileged principal is updating.

An issue exists where user-controlled message fields are rendered as templates without proper neutralization, leading to server-side template injection. An authenticated attacker with a common operational role can inject template expressions that the server evaluates in an unrestricted context.

Missing authentication in the realtime streams POST handler allows unauthenticated attackers to inject arbitrary data into run streams across any environment, including production. This occurs because the `action` handler in the file `apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts` lacks an authentication wrapper. Furthermore, the system performs run lookups using the `friendlyId` variable without verifying the `runtimeEnvironmentId`, and these identifiers follow predictable patterns. The affected API endpoint is '/realtime/v1/streams/:runId/:streamId'.

An authorization failure occurs in the 'commands/results' endpoint where MDM command results are not properly filtered by team authorization. This allows team-scoped users to access MDM command results for hosts belonging to other teams when a shared command UUID targets hosts across multiple teams. This exposure includes host UUIDs, command payloads, and device responses.

The '/datasources/unauth-datasource' endpoint fails to properly enforce authorization for data sources. An authenticated user can call this endpoint to retrieve information about data sources they are not permitted to access, potentially exposing sensitive metadata and data source configurations.

Users with personal API tokens can retrieve replies from questions in private spaces they are not authorized to access. This occurs because the `getPostReplies()` function in `ApiController.java` fails to apply the `canAccessSpace` check before returning data from the 'GET /api/posts/{id}/answers' endpoint. The issue is exploitable when `scoold.api user access enabled` and `scoold.api enabled` are set to true and a token holder identifies or enumerates a private question identifier. Consequently, while the question endpoint may deny access, the answers endpoint returns private reply bodies, exposing confidential team or project discussions.

Authenticated users who are not members of a private space can create content in questions belonging to that space. This occurs because the `reply()` function in `QuestionController.java` and the `createAjax()` function in `CommentController.java` fail to apply the `canAccessSpace` authorization check. When `scoold.is default space public` is set to false and private spaces are active, a user with a valid session and a known or enumerable question identifier can send requests to the endpoints 'POST /question/{id}' and 'POST /comment'. This allows unauthorized modification of private discussions and may trigger notifications that reveal metadata or the existence of private activity.

Improper validation of certificates with host mismatch occurs in the MQTT client TLS connection layer, specifically affecting X.509 mutual authentication on port 8883 and WebSocket SigV4 on port 443. This flaw allows an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint by using a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. Consequently, an attacker can read device telemetry and inject arbitrary MQTT messages that the device processes as authentic.

An issue exists where the `getThemeFolder()` function in `admin/controller/editor/revisions.php` returns the `theme` parameter without proper sanitization. The `backupFolder()` function then concatenates this parameter beneath `DIR THEMES` before the `editor/revisions/load` or `editor/revisions/delete` endpoints operate on a .html file. While `sanitizeBackupFileName()` removes traversal characters from the file parameter, it fails to protect the theme directory component. An authenticated user with the Editor role and `editor/*` permission can use traversal sequences to redirect `file get contents()` or `unlink()` to backup subdirectories outside the web root. This requires a valid admin session and CSRF token. The impact includes the disclosure of sensitive exported site content (limited to .html files in backup directories) or the removal of backup data, provided the system has filesystem write permissions.

A privilege escalation issue exists in the '/join tables' endpoint. The system fails to validate the role or workspace membership of authenticated users, granting them the JOIN TABLES ability. This allows an authenticated attacker to read arbitrary tables from any workspace by providing the target workspace identifiers in the request path while using their own valid credentials.

Low-privilege users with the BASIC role can bypass table-level access controls by submitting crafted query requests to the 'POST /api/datasources/query' endpoint. This allows them to read, create, update, or delete rows in any table, regardless of the configured per-table role restrictions.

An authorization flaw exists in the 'POST /api/resources/duplicate' endpoint. Authenticated builders can inject tables, automations, queries, and screens into any application by specifying an arbitrary destination workspace ID in the request body, even without a role in the target workspace. This allows attackers to trigger injected automations using outgoing webhooks to exfiltrate data from the victim applications.

A low-privilege API user can access the cleartext cluster key through a configuration endpoint that fails to redact sensitive information. While the REST API typically uses a masking control called `mask sensitive config` to hide fields like `authd.pass` and `cluster.key` from users without `update-config` permissions, the 'GET /cluster/local/config' endpoint does not implement this control. This endpoint, which uses the `read config wrapper` function, only requires `cluster:read` permissions. Consequently, accounts with `readonly` or `cluster readonly` roles can retrieve the actual cluster key. Since this key is used to authenticate and encrypt traffic between cluster nodes, its disclosure can facilitate remote code execution chains between cluster peers.

The MCP HTTP Stream `mcp post` handler fails to enforce a maximum number of sessions and does not invoke the ` cleanup sessions()` function to expire old entries. Consequently, every `initialize` request creates a new in-memory session that is never removed. Additionally, the `notifications/cancelled` endpoint populates a ` cancelled requests` set that is never pruned. Since the `initialize` request is unauthenticated, a remote attacker can send repeated requests to exhaust system memory, leading to a denial of service when the process is terminated by the out-of-memory killer. This issue is further amplified by the fact that the server retains SSE event history for each session.

The built-in SCTP stack authenticates state cookies using hardcoded magic values instead of a per-instance secret and HMAC, which deviates from RFC 9260 Section 5.1.3. This flaw in `StateCookie::IsMediasoupStateCookie()` and `Association::HandleReceivedCookieEchoChunk()` allows an on-path attacker targeting `PlainTransport` or `PipeTransport` with SCTP enabled and without DTLS protection to forge a COOKIE-ECHO. By matching the packet verification tag with a `localVerificationTag` controlled by the attacker, an unauthorized SCTP association can be established, enabling DataChannel message injection as a trusted peer. SCTP is a transport layer protocol used to ensure reliable delivery of data.

A Cross-Site Request Forgery (CSRF) issue exists in the MCP HTTP-stream transport. The ` validate origin()` function in `transports/http stream.py` uses a prefix match via `startswith()` to validate the `request origin` variable against an allowlist. This allows an attacker to bypass the check by using a domain that begins with an allowed prefix, such as `http://localhost.attacker.com`. Because the server may be run without an API key by default and parses request bodies regardless of the `Content-Type` header, an attacker can send a CORS simple request using `text/plain`. This bypasses the browser preflight check and allows the unauthenticated invocation of the `tools/call` endpoint. An attacker can exploit this to perform state-changing actions, most notably using the `praisonai.rules.create` tool to write malicious files into the global rules directory. This results in persistent prompt injection, where attacker-controlled instructions are applied to every subsequent agent run on the victim's machine, potentially leading to the exfiltration of sensitive data like SSH keys and API keys. Other affected tools include `praisonai.rules.delete`, `praisonai.todo.add`, `praisonai.todo.delete`, and `praisonai.schedule.add`.