Jvr2022

**Name of the Vulnerable Software and Affected Versions** better-auth SCIM versions 1.5.0 through 1.7.0-beta.3 **Description** By default, the `@better-auth/scim` plugin fails to bind non-organization (personal) SCIM providers to their creator. This occurs because the `providerOwnership` option and the `scimProvider.userId` column are disabled by default, allowing the access check to pass when no owner ID is present. Consequently, any authenticated user can manage other users' personal providers, including reading metadata, listing connections, and deleting connections. The most critical impact is the ability to regenerate SCIM bearer tokens via the `/scim/generate-token` endpoint using the `providerId` variable. This action invalidates the legitimate user's token and grants the attacker a valid token to authenticate against SCIM API routes, such as `/scim/v2/Users`, and manage SCIM-provisioned users. **Recommendations** Upgrade to `@better-auth/scim` version 1.7.0-beta.4 or later and run the schema migration using `npx auth migrate`. As a temporary workaround, set `providerOwnership: { enabled: true }` during plugin registration and run the schema update to ensure the `scimProvider.userId` column exists. As an alternative mitigation, ensure all SCIM providers are scoped to an organization by always providing an `organizationId`. Restrict access to SCIM management endpoints at the network edge to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions 9.1.0 through 9.3.2 **Description** An authorization bypass occurs because the software decodes the encoded slash %2F within path parameter values before matching middleware paths, whereas the underlying router preserves this encoding during route lookup. This discrepancy allows a request to bypass middleware used for authentication, authorization, rate limiting, or auditing on parameterized paths, enabling an attacker to reach a protected handler using a crafted URL with an encoded slash in the parameter position. This issue is agnostic to the HTTP method and requires no authentication or special preconditions. **Recommendations** Upgrade to @fastify/middie version 9.3.3. Avoid using parameterized middleware paths for security decisions. Enforce authentication at the route handler or via a Fastify hook that executes after the router has resolved the request.

**Name of the Vulnerable Software and Affected Versions** @fastify/middie versions 9.1.0 through 9.3.2 **Description** An issue exists in the standalone engine's URL normalization and decoding process where malformed percent-encoded sequences in incoming request paths are not properly guarded. Specifically, inputs such as truncated multibyte sequences or incomplete percent escapes cause the underlying decoder to throw a synchronous exception. This exception escapes the normalization step and terminates the Node.js process, resulting in a denial of service for all connected clients. This affects applications that call the `middie.run()` function directly via the standalone engine API. Applications using the Fastify plugin path are not affected as the framework's error handler catches the exception. **Recommendations** Upgrade to @fastify/middie version 9.3.3. Migrate from the standalone engine API to the Fastify plugin path to allow the framework error handler to catch the exception.

**Name of the Vulnerable Software and Affected Versions** @fastify/express versions prior to 4.0.7 **Description** A middleware scoping flaw exists where plugin prefixes are not applied to middleware mount paths when the mount path is provided as an array or a regular expression. This occurs due to improper input handling during prefix and path normalization, causing middleware to be registered without the prefix inside prefixed plugin scopes. An attacker can bypass security controls such as authentication, authorization, rate limiting, or auditing by sending requests to routes under a prefixed plugin where the middleware was mounted using non-string paths. Fastify continues to match the route, but the associated middleware is skipped. **Recommendations** Upgrade to @fastify/express version 4.0.7. As a temporary workaround, use string mount paths instead of arrays or regular expressions in prefixed plugins, or register one use call per path.

**Name of the Vulnerable Software and Affected Versions** node-tar versions prior to 7.5.19 **Description** Insufficient enforcement of hard upper bounds on total decompressed data, entry counts, or decompression ratio within extraction and parsing paths, such as `src/extract.ts`, allows a crafted gzip bomb to exhaust CPU and disk space. A gzip bomb is a highly compressed archive that expands to an enormous size when decompressed, leading to a denial of service. **Recommendations** Update to version 7.5.19.

**Name of the Vulnerable Software and Affected Versions** node-tar versions prior to 7.5.18 **Description** The `tar.replace` function accepts a checksum-valid tar header containing a negative base-256 encoded entry size. This causes the archive scanner to enter a loop where it repeatedly parses the same header without making progress. **Recommendations** Update to version 7.5.18.

**Name of the Vulnerable Software and Affected Versions** better-auth versions prior to 1.6.2 **Description** An issue exists where the software fails to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE (Proof Key for Code Exchange). In the `parseGenericState` function, the cookie branch decrypted the `oauth state` cookie and validated expiry but did not compare the incoming OAuth `state` query parameter to the nonce issued at sign-in. This allows attackers to forge the `state` parameter and provide an attacker-controlled authorization code to the `/api/auth/oauth2/callback/<providerId>` endpoint. This can lead to forced-login (CSRF on OAuth callback), where a victim's browser is placed into a session bound to the attacker's external identity, or persistent account linking, where an attacker's external account is bound to the victim's authenticated profile. **Recommendations** Upgrade to version 1.6.2 or later. Switch `storeStateStrategy` to `database`. Enable `pkce: true` on every affected `genericOAuth` provider.

**Name of the Vulnerable Software and Affected Versions** Quarkus OpenAPI Generator versions prior to 2.11.1-lts Quarkus OpenAPI Generator versions prior to 2.16.0-lts Quarkus OpenAPI Generator versions prior to 2.17.0 **Description** The generated authentication filter matches OpenAPI path templates too broadly when determining whether to attach credentials. The runtime authentication layer compares the outgoing request path and method against protected OpenAPI operations, but treats `{param}` placeholders as `.*`, which incorrectly allows a single path parameter to consume a forward slash (`/`). Consequently, a security scheme configured for one operation may be applied to a different operation of the same method if the path partially resembles the protected template. This can lead to bearer tokens, API keys, or basic credentials being sent to unintended endpoints, potentially disclosing sensitive information to lower-trust routes on the same service. **Recommendations** Update to version 2.11.1-lts. Update to version 2.16.0-lts. Update to version 2.17.0.

**Name of the Vulnerable Software and Affected Versions** OpenLearn versions prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab **Description** When `safeMode` is enabled, unapproved forum posts are hidden from the public list. However, the direct post-read procedure still returns the full post to any user who possesses the post UUID. **Recommendations** Update to commit 844b2a40a69d0c4911580fe501923f0b391313ab.

**Name of the Vulnerable Software and Affected Versions** @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions 0.6.0 and earlier **Description** Seven recursive traversals in `lib/dom.js` operate without a depth limit. When processing a sufficiently deeply nested DOM tree, the JavaScript call stack is exhausted, resulting in a `RangeError: Maximum call stack size exceeded` and crashing the application. This can lead to a denial of service if a service accepts attacker-controlled XML and performs any of the affected operations. The affected functions and entry points include - `Node.prototype.normalize()` - `XMLSerializer.serializeToString()` - `Element.getElementsByTagName()`, `getElementsByTagNameNS()`, `getElementsByClassName()`, and `getElementById()` (via the ` visitNode` function) - `Node.cloneNode(true)` - `Document.importNode(node, true)` - `node.textContent` (getter) - `Node.isEqualNode(other)` **Recommendations** Update @xmldom/xmldom to version 0.8.13 or 0.9.10. Update xmldom to a version later than 0.6.0. As a temporary workaround, restrict the use of the affected functions or limit the nesting depth of XML documents before they are processed by the library.

**Name of the Vulnerable Software and Affected Versions** @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions prior to 0.6.0 **Description** The software allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. This occurs during the DOM construction and serialization flow for comment nodes when the `createComment()` function is called; the supplied string is stored as-is and later concatenated with XML comment delimiters during serialization. Because XML comments are syntax-sensitive, an attacker can provide input containing a sequence that closes the comment, allowing them to terminate the comment early and inject arbitrary XML nodes into the serialized output. This can enable an attacker to alter the meaning and structure of generated XML documents, affecting workflows that store, forward, sign, or parse the resulting XML, such as configuration or policy documents. **Recommendations** For @xmldom/xmldom versions prior to 0.8.13 and 0.9.10, update to version 0.8.13 or 0.9.10 and explicitly pass the `{ requireWellFormed: true }` option to the `serializeToString()` function to enable protection. For xmldom versions prior to 0.6.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vite+ versions prior to 0.1.17 **Description** The `downloadPackageManager()` function accepts an untrusted `version` string and uses it directly in filesystem paths. This allows a caller to use absolute paths or `../` segments to escape the `VP HOME/package manager/<pm>/` cache root, enabling the deletion, replacement, and population of directories outside the intended cache location. **Recommendations** Update to version 0.1.17.

Name of the Vulnerable Software and Affected Versions PolarLearn versions 0-PRERELEASE-15 and earlier Description The software creates a valid session for banned accounts before verifying the supplied password via the `/api/v1/auth/sign-in` API endpoint. This session is then accepted across authenticated API routes, allowing access to account data and authenticated actions as the banned user. The vulnerable parameter is the `password`. Recommendations Update to a version later than 0-PRERELEASE-15.

Name of the Vulnerable Software and Affected Versions PolarLearn versions prior to 0-PRERELEASE-15 Description PolarLearn is a learning program affected by a privilege-escalation issue. An inverted admin check in the `account-management` module allowed authenticated non-admin users to execute the `setCustomPassword(userId, password)` and `deleteUser(userId)` actions, while legitimate administrators were blocked. The issue stems from an incorrect conditional statement that reverses the intended access control logic. Recommendations Update to version 0-PRERELEASE-15 or later.

**Name of the Vulnerable Software and Affected Versions** node-tar versions prior to 7.5.10 **Description** A flaw in the extraction logic allows an attacker to create a hardlink that points outside the intended extraction directory. By using a drive-relative link target, such as `C:../target.txt`, the software can be tricked into bypassing path restrictions. This occurs because the logic checks for `..` segments before stripping absolute roots, allowing the `linkpath` to escape the current working directory (`cwd`) during the execution of the `tar.x()` function. This results in an arbitrary file overwrite primitive with the permissions of the process performing the extraction, which is particularly critical for services that unpack untrusted archives or build pipelines consuming third-party files. **Recommendations** Update node-tar to version 7.5.10 or later.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions prior to 0-PRERELEASE-16 **Description** PolarLearn is a free and open-source learning program. The group chat WebSocket at `wss://polarlearn.nl/api/v1/ws` can be used without authentication. An unauthenticated client can subscribe to any group chat by providing a group UUID and send messages to any group. The server accepts and stores these messages in the group’s `chatContent`. **Recommendations** Update PolarLearn to version 0-PRERELEASE-16 or later.

**Name of the Vulnerable Software and Affected Versions** @isaacs/brace-expansion versions prior to 5.0.1 **Description** @isaacs/brace-expansion, a hybrid CJS/ESM TypeScript fork of brace-expansion, is subject to a denial of service (DoS) issue. This occurs due to unbounded brace range expansion when processing patterns with repeated numeric brace ranges. The library attempts to generate all possible combinations synchronously, leading to excessive CPU and memory consumption, potentially crashing the Node.js process. **Recommendations** Update @isaacs/brace-expansion to version 5.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions 0-PRERELEASE-15 and earlier **Description** A timing attack in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. The vulnerability occurs because the server performs Argon2 password hashing only if the user exists in the database. Requests for existing users take approximately 650ms, while requests for non-existent users take approximately 160ms. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. The vulnerable API endpoint is the login endpoint. The `email address` is the vulnerable parameter. **Recommendations** Apply a fix to ensure consistent response times for both valid and invalid email addresses during the sign-in process.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions 0-PRERELEASE-15 and earlier **Description** The OAuth 2.0 implementation for GitHub and Google login providers is susceptible to Login Cross-Site Request Forgery (CSRF). The application does not implement and verify the state parameter during the authentication process. This allows an attacker to pre-authenticate a session and deceive a victim into logging into the attacker’s account. As a result, any data entered or academic progress made by the victim is stored on the attacker’s account, potentially leading to data loss for the victim and information disclosure to the attacker. **Recommendations** Versions prior to 0-PRERELEASE-15 should be updated.

**Name of the Vulnerable Software and Affected Versions** PolarLearn versions prior to 0-PRERELEASE-15 **Description** PolarLearn is a free and open-source learning program. The `POST /api/v1/forum/vote` API route trusts the `direction` value within the JSON body without runtime validation. TypeScript types are not enforced during runtime, allowing an attacker to send arbitrary strings, such as `"x"`, as the `direction` parameter. The `VoteServer` component interprets any value other than `"up"` or `null` as a downvote, persisting the invalid value in `votes data`. This can be used to bypass intended business logic. **Recommendations** Update to version 0-PRERELEASE-15 or later.