Jeroen Pinoy

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process. Successful exploitation could result in unauthorized modification of application or system files, denial of service, and potentially further compromise depending on the permissions of the Pandora process and the files that can be overwritten. The vulnerability is addressed by resolving each extraction destination path before writing and verifying that it remains below the expected extraction directory. Extraction attempts resolving outside this directory are rejected and reported as path traversal attempts.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Stored Cross-Site Scripting (XSS) occurs because calendar event titles are rendered using `innerHTML`. Since these titles are derived from case titles, a user with permissions to create or modify a case title can inject HTML or script-capable content. This content is subsequently executed by the browser when another user views the calendar. The issue involves the use of `innerHTML` to assign the `arg.event.title` variable. **Recommendations** For versions 3.3.0 and later, update the software to replace the use of `innerHTML` with `textContent` when rendering the `arg.event.title` variable and the static download icon.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** An authorization flaw exists in the administrative user-edit API. While the system prevents organization administrators from editing users in different organizations, it fails to restrict them from modifying full administrator accounts within their own organization. This allows an organization administrator to change the password of a full administrator, leading to privilege escalation. The issue is addressed by implementing a privilege boundary check using the `is admin()` function to block these modifications. **Recommendations** Update Flowintel to a version where the `is admin()` boundary check is implemented in the user-edit API to prevent organization administrators from modifying full administrator accounts.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Flowintel allows the `LOG FILE` configuration value to be modified via system settings without restricting it to the intended log directory. This allows an administrator to set `LOG FILE` to an arbitrary filesystem path. Because attackers can influence the content being logged, they can write controlled data into unintended files. This can lead to remote code execution through an exploitation chain where an attacker injects a template into a file and abuses the application rendering behavior. The fix involves the `validate log file name()` function to reject absolute paths, traversal, Windows paths, null bytes, and directory components, while centralizing path construction through `resolve log file path()`. **Recommendations** Update Flowintel to a version where `LOG FILE` is removed from web-editable settings and path validation is implemented. As a temporary mitigation, restrict administrative access to system settings to prevent the modification of the `LOG FILE` configuration value.

**Name of the Vulnerable Software and Affected Versions** Flowintel version 3.3.0 **Description** An authorization flaw exists where the '/my assignment/user' API endpoint is accessible to any authenticated API user. The endpoint utilizes a `user id` parameter to identify the user whose assignments are retrieved, but it lacks proper role-based access control. This allows a lower-privileged authenticated user to access assignment information of other users by providing their respective identifiers. **Recommendations** Update Flowintel version 3.3.0 to a version where the '/my assignment/user' endpoint is restricted to administrators or organization administrators.

**Name of the Vulnerable Software and Affected Versions** Flowintel (affected versions not specified) **Description** An issue exists where attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export. This can lead to the unauthorized reading of local files from the Flowintel server, which are then incorporated into the generated export file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** An issue exists where login email addresses are incorrectly validated. The system calls `Email(email)`, which only constructs a validator object instead of performing actual WTForms field validation. This allows malformed, attacker-controlled email input to proceed through the login process and be written to security-relevant logs, including a warning log and a custom audit logger. Because carriage return (CR) and line feed (LF) characters are not escaped, an unauthenticated attacker can perform log injection by inserting additional physical log lines or forging misleading log entries. **Recommendations** For versions 3.3.0 and later, update the software to the patched version that corrects the validation call to `Email()(form, form.email)`, implements parameterized logging, and utilizes the ` sanitize log fragment()` function to encode carriage returns and line feeds.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Authenticated sessions are not revoked when a user changes their password. This allows an attacker with a valid session token to maintain access to the account until the session expires naturally, even after the password has been updated. The issue occurs within the `edit user core()` and `admin edit user core()` functions, where the system fails to call ` invalidate user sessions(user.id)` following a database update. **Recommendations** Update Flowintel to a version where the `edit user core()` and `admin edit user core()` functions explicitly invoke ` invalidate user sessions(user.id)` upon password changes.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Stored Cross-Site Scripting (XSS) occurs when Mermaid blocks in case notes are rendered without sufficient neutralization of attacker-controlled markup. An attacker with permissions to create or edit notes can store a crafted Mermaid payload that executes JavaScript in the browser of any user who views the affected case note. **Recommendations** Update Flowintel to a version where Mermaid detection and HTML escaping are implemented for token content and wrapping logic is moved earlier in page initialization.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Flowintel constructs timeline HTML by directly concatenating attacker-controllable MISP object fields into HTML strings before rendering. The affected fields include the object UUID, object name, attribute value, attribute type, comment, first/last seen values, and IDS flag. Although DOMPurify was used to remove XSS vectors, other HTML elements, such as forms, were still permitted, leading to HTML injection. **Recommendations** For versions 3.3.0 and later, update the software to a version where direct string interpolation is replaced with DOM construction via `document.createElement()` and attacker-controlled values are assigned using `textContent`.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and later **Description** Flowintel improperly trusts configuration keys provided to the alerts settings update endpoint. While configuration values are normalized to Python literals, the keys are used directly to construct and replace lines within the `conf/config module.py` file. The system uses requester-controlled keys in both the regular expression and the generated assignment `f'{key} = {py val}'`, appending the assignment if the key is missing. Because the modified configuration module is subsequently reloaded using `importlib.reload()`, a code-generation boundary is created. This allows specially crafted configuration keys to alter the Python source structure, leading to the execution of attacker-controlled Python statements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flowintel versions 3.3.0 and earlier **Description** An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case identifier. Consequently, an authenticated user with editor-level access to one case could substitute a task ID from a different case to perform unauthorized operations. This affects endpoints related to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, and external-reference. Additionally, the system did not verify if a `note id` belonged to the current task during retrieval or export operations. **Recommendations** Update to a version later than 3.3.0.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** Weaknesses in the authentication endpoint allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially cause a denial of service. The login process previously verified the existence of a username before performing password hash verification, creating a timing discrepancy that allows attackers to identify valid accounts. Additionally, the '/login' endpoint lacks restrictions on the frequency of failed attempts, enabling brute-force, dictionary, password-spraying, or credential-stuffing attacks. Because the password key-derivation function consumes significant CPU time, a high volume of requests can exhaust synchronous Gunicorn workers, leading to application-wide unavailability. **Recommendations** Implement password verification using a dummy password hash when a username does not exist to eliminate timing discrepancies. Apply rate-limiting for failed authentication attempts per client IP address. Configure the reverse-proxy to derive client addresses from a trusted `X-Forwarded-For` value that cannot be overridden by the client.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** A missing authentication flaw exists in the '/admin/crypto/group/new' endpoint. This endpoint, intended for the administrative creation of new crypto group entries, lacks protection from the application's authentication mechanism. An unauthenticated remote attacker with access to the web interface can submit requests to this endpoint to create crypto group entries without a valid session or administrative credentials. This allows unauthorized modifications to data restricted to administrators and may compromise the integrity of information processed or presented by the application. **Recommendations** Apply the `flask login.login required` decorator to the '/admin/crypto/group/new' route to ensure only authenticated users can access this functionality.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** The application creates its Flask session-signing key without explicitly restricting file permissions, often resulting in permissions like 0644. This allows local users with access to the home directory to read the `secret key` file. This cryptographic secret is used to sign Flask session cookies and for legacy API-key key derivation. An attacker with this key can generate valid session cookies to impersonate authenticated users, including administrators. In LDAP configurations, this is simplified as the session user loader does not verify if the username corresponds to an existing local user. Successful exploitation requires local file system access and can lead to a complete compromise of authentication and authorization controls. **Recommendations** Update the software to the patched version that creates secret-key files with 0600 permissions and restricts permissions on existing key files during startup. Restrict local access to the RansomLook home directory to prevent unauthorized users from reading the `secret key` file.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** An authorization flaw exists in the legacy database export functionality that allows unauthenticated remote users to retrieve private information. The `/export/<database>` endpoint allows the export of selected internal databases without authentication. Because the application does not consistently apply private-entity access restrictions to all exportable databases, records associated with groups, markets, and posts marked as private may be disclosed. This could lead to the exposure of private ransomware intelligence, victim information, and internal tracking data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/export/<database>` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** The authenticated `/admin/apikeys` administration page exposes complete API keys within the HTML source. While the user interface shows only a shortened version of the key, the full token is embedded in hidden form fields used for enable/disable, private-access, and delete actions. This allows API credentials to be recovered by inspecting the page source or Document Object Model (DOM). Additionally, these credentials may be exposed through browser caches, debugging proxies, monitoring systems, or other intermediaries that inspect HTTP response bodies. An attacker with access to these tokens can authenticate with the privileges assigned to the key, potentially gaining access to private data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** Sensitive operator-side scraping configuration is exposed through multiple unauthenticated API responses. Location records associated with ransomware groups and markets are returned to unauthenticated callers if the location is not marked as private. These records may contain internal fields such as `header`, which can include authentication headers, session cookies, or credentials; `init script`, which may contain logic to bypass CAPTCHA, anti-bot protections, or paywalls; and `browser`, which discloses scraping environment details. An unauthenticated remote attacker can query the affected API endpoints to obtain these values, potentially replaying authentication material against monitored services or identifying and defeating collection mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** An authorization weakness exists in the web-based configuration editor. The '/admin/config' endpoint requires an authenticated session but fails to perform explicit privilege or administrator authorization checks. This allows an authenticated low-privileged user to submit crafted configuration values that are written directly to the `config/generic.json` file. Affected functionality includes the modification of notification, LDAP, SMTP, and general application settings. Exploitation could enable an attacker to alter security-sensitive behavior, redirect integrations, modify authentication configurations, disrupt external services, or cause a denial of service. Additionally, the configuration editor handles sensitive data such as passwords, tokens, secrets, and API keys, increasing the risk associated with compromised low-privileged accounts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RansomLook (affected versions not specified) **Description** RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic verifies if an individual post is private but fails to check the privacy configuration of the associated group or market. This allows victim information from private entities to be automatically published via Rocket.Chat, Mastodon, Bluesky, and e-mail notification channels. Additionally, the public MISP feed (Malware Information Sharing Platform) incorrectly determined privacy using the `groupinfo()` function, which only queries the group database and ignores market privacy flags. Unauthorized parties accessing these channels or the feed may obtain sensitive data, including victim names and incident information from privately monitored entities. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.