Hyderpwn

**Name of the Vulnerable Software and Affected Versions** AiSOC versions 9.0.0 through 11.9.9 **Description** Authentication is not enforced on the response-action API endpoints when `AISOC DEV MODE` is enabled and `AISOC ACTIONS SERVICE TOKEN` is empty within the default Docker Compose deployment. This allows unauthenticated attackers to list response-action integrations, submit and approve actions as arbitrary principals, and dispatch containment actions using vendor credentials. **Recommendations** Update AiSOC to version 12.0.0 or later. Disable `AISOC DEV MODE` in production environments. Ensure `AISOC ACTIONS SERVICE TOKEN` is properly configured and not left empty.

**Name of the Vulnerable Software and Affected Versions** AiSOC versions prior to 12.0.0 **Description** An authorization bypass exists in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. By submitting tenant UUIDs via the 'add tenants to portfolio' endpoint, attackers can claim unclaimed tenants to access security alerts, incidents, and posture metrics without consent. The `tenant UUID` variable is used to identify the target tenant during this process. **Recommendations** Update AiSOC to version 12.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** AiSOC versions 7.5.0 through 11.x **Description** The realtime WebSocket and SSE service uses a hard-coded constant for JSON Web Token (JWT) verification when the `AISOC REALTIME JWT SECRET` environment variable is not configured. This allows unauthenticated attackers to forge subscription tickets using arbitrary tenant identifiers, enabling unauthorized access to cross-tenant live alerts, cases, agent events, and graph updates via the realtime endpoints. **Recommendations** Update AiSOC to version 12.0.0 or later. Set the `AISOC REALTIME JWT SECRET` environment variable to a secure, unique value to ensure proper JWT verification.

**Name of the Vulnerable Software and Affected Versions** AiSOC versions 7.2.0 through 11.x **Description** The actions service contains a flaw when building CrowdStrike Real Time Response command strings by interpolating unescaped action parameters within `crowdstrike rtr.py` and `endpoint.py`. Authenticated users can inject single quotes into the `file path`, `path`, `script name`, or `script args` parameters to bypass quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges. **Recommendations** Update AiSOC to version 12.0.0 or later. Restrict the use of the `file path`, `path`, `script name`, and `script args` parameters until the update is applied.

**Name of the Vulnerable Software and Affected Versions** AiSOC versions 5.1.0 through 11.9.9 **Description** An authentication bypass exists in the realtime service internal endpoints 'POST /internal/agent-event' and 'POST /internal/push'. This allows attackers to submit arbitrary events using spoofed tenant identifiers to broadcast malicious content via WebSocket and Redis SSE (Server-Sent Events) channels, or to send unauthorized notifications to registered devices. **Recommendations** Update AiSOC to version 12.0.0 or later. Restrict access to the 'POST /internal/agent-event' and 'POST /internal/push' endpoints to minimize the risk of exploitation.