Hk4Zczi

**Name of the Vulnerable Software and Affected Versions** Dockge (affected versions not specified) **Description** Insufficient validation of stack names occurs because the allow-list check in the `validate()` function within `backend/stack.ts` is only applied during the save process. The `Stack.getStack` function and the path getter in `backend/stack.ts` use `path.join()` without validating the `stackName` variable, allowing path traversal sequences to resolve outside the managed stacks directory. In `backend/agent-socket-handlers/docker-socket-handler.ts`, socket handlers pass the name directly to `Stack.getStack` after only verifying that the caller is logged in and the name is a string. This allows an authenticated user to read `composeENV` and `composeYAML` values from any directory accessible to the server process, disclosing secrets in `.env` or Compose files. Additionally, an attacker can call the `delete()` function, which executes `docker compose down` followed by `fsAsync.rm` with recursive and force options, deleting the targeted directory. This risk is amplified when Dockge runs as root or when the `disableAuth` option is enabled, which allows these operations without authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 9router (affected versions not specified) **Description** An issue exists in the `POST /api/provider-nodes/validate` endpoint where the application issues server-side HTTP requests to a caller-supplied `baseUrl`. The security mechanism `assertPublicUrl` in `src/shared/utils/ssrfGuard.js` fails to properly validate destinations because it only compares hostname strings without performing DNS resolution or revalidating after redirects. Specifically, the check for IPv4-mapped IPv6 addresses is unreachable because the WHATWG URL parser canonicalizes these literals to hextets before the guard processes them. This allows IPv4-mapped addresses to bypass the filter and reach loopback or link-local metadata addresses. Additionally, hostnames with A records pointing to internal addresses are permitted. In the custom-embedding branch, if the upstream status is not 2xx, 401, or 403, the first 200 bytes of the response body are returned to the caller, potentially disclosing internal information. Other validation types can be used for blind internal port scanning via timing and status differences. The `apiKey` provided by the caller is forwarded to the internal destination as an Authorization Bearer header. Access typically requires a dashboard session unless `requireLogin` is disabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RAGFlow versions prior to 0.26.3 **Description** A server-side request forgery (SSRF) issue exists in the agent workflow "Invoke" component located in `agent/component/invoke.py`. The component constructs outbound request URLs using canvas configuration and runtime template variables, then processes them via `requests.get`, `requests.post`, or `requests.put` without utilizing the `assert url is safe` validator or pinning the resolved address. This allows a user capable of creating or triggering an agent to force the server to fetch data from loopback, link-local, and RFC 1918 destinations, such as cloud instance metadata endpoints and services co-located on the deployment network. If an agent is configured to interpolate the chat query into the Invoke URL, the destination can be controlled by any user sending that query. **Recommendations** Update RAGFlow to version 0.26.3 or later.

**Name of the Vulnerable Software and Affected Versions** Next AI Draw.io versions prior to 0.4.17 **Description** An issue exists in the 'POST /api/parse-url' endpoint where hostname validation is performed using string patterns without DNS resolution. This allows unauthenticated attackers to use hostnames that bypass these checks but resolve to internal addresses, enabling server-side request forgery (SSRF). This can be used to access arbitrary internal HTTP services and exfiltrate sensitive data, such as cloud metadata. **Recommendations** Update Next AI Draw.io to version 0.4.17 or later. As a temporary mitigation, restrict access to the 'POST /api/parse-url' endpoint.

**Name of the Vulnerable Software and Affected Versions** Next AI Draw.io versions 0.2.1 through 0.4.16 **Description** A reflected cross-site scripting issue exists where the `mcp` query parameter is interpolated into HTML and JavaScript without proper escaping. This allows attackers to use malicious URLs to execute arbitrary JavaScript within the localhost origin, which can lead to the exfiltration of API data and diagram sessions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `mcp` query parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** kotaemon versions prior to 0.12.1 **Description** An insecure deserialization issue exists in the 'check connection' endpoint. Unauthenticated attackers can instantiate arbitrary Python classes by providing crafted YAML or JSON input containing a ` type ` field. By overriding the ` type ` field with the `subprocess.check output()` function and providing arbitrary arguments, an attacker can achieve remote code execution with the privileges of the application process. **Recommendations** Update kotaemon to a version later than 0.12.0. As a temporary mitigation, restrict access to the 'check connection' endpoint.