Hackchang

An information disclosure issue exists where project members with read-level access can obtain plaintext integration secrets. This occurs because the `notification.rules` tRPC query fails to execute the `redactIntegration` function. An attacker can utilize the `notification.rules` query to retrieve sensitive data, including Slack bot tokens, webhook URLs, and authorization headers, which can then be used against external systems.

An unauthenticated SQL injection issue exists in the ClickHouse database integration. Remote attackers can inject SQL via the `projectId` parameter of the `/live/visitors/:projectId` WebSocket endpoint, which fails to perform session and project-access validation. This allows the use of UNION or boolean count oracles to access events and profiles belonging to other tenants. Additionally, project members can perform similar injections using the `cohort.preview` timeframe values.

An SQL injection issue exists where API token holders can execute arbitrary SQL commands. By providing crafted values to the `include info` variable at the '/api/locations/list' endpoint, attackers can insert subqueries that the `getSpecificInfo()` function in PlantsModel concatenates into the column list. This allows for the unauthorized reading of any database table, including user password hashes.

An unrestricted file upload issue exists in the `PlantAttachmentModel` that allows authenticated users to store files with client-supplied extensions in the `public/attachments/` directory. By using the '/plants/attachments/add' endpoint, attackers can upload HTML or SVG files to perform stored cross-site scripting (XSS), a technique where malicious scripts are permanently stored on the server and served to other users. Additionally, if `.htaccess` is unenforced, PHP files can be uploaded to execute arbitrary code on the server.

Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the `service name` and `span name` fields into ClickHouse string literals without proper escaping.

The HTTP handler fails to apply authorization wrappers to trace-funnel analytics endpoints. This allows unauthenticated attackers to submit arbitrary funnel definitions to retrieve trace analytics, including identifiers, durations, span counts, service topology, and error activity, without providing credentials.

An authentication bypass exists in the `validateToken()` middleware. The issue stems from improper trust in spoofable request headers and flawed request flow control, which allows the `next()` function to be called before authentication checks are completed. Specifically, a service-to-service bypass is triggered when the `auth-user` header is set to `service-brother` and the `Host` header starts with the value returned by `getHostName()`. Since both the `auth-user` and `Host` headers are controlled by the client, a remote unauthenticated attacker can craft these headers to skip legacy, JWT, or OIDC token validation, potentially leading to unauthorized access, privilege escalation, and lateral movement.