Kmkz

A pre-authentication reflected cross-site scripting issue exists where unauthenticated attackers can inject and execute arbitrary JavaScript. This is achieved by submitting a crafted `LINK` query parameter to the '/System/Session-1' endpoint. Exploitation can lead to credential harvesting, manipulation of the login flow, access to browser-visible data, and the execution of same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.

Hardcoded credentials allow unauthenticated attackers to recover static OAuth `clientId` and `clientSecret` values embedded in JavaScript delivered to the frontend, such as in the `parameters.js` file. Attackers can use these exposed credentials to reproduce the application portion of the REDY authentication flow at the '/web/api/v1/auth/token' endpoint, which undermines the confidential-client assurance of the OAuth implementation.

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.

An issue was discovered where an attacker can access the server without authentication in the case of a default installation without a security realm reference. This is because the configuration is effectively unsecured, as indicated by the Security Realms documentation in the product's Admin Guide. The vendor supports these unsecured configurations due to valid use cases during development.

An issue allows an attacker to access the administration panel without authentication using `anonymous` access. Once logged in, a misconfiguration permits an anonymous user to deploy a malicious .war file, leading to remote code execution. The vendor notes that anonymous access is not available by default but remains optional for certain use cases, such as development environments.

The issue allows local users to conduct a jailbreak attack and obtain root privileges by overwriting the /etc/shadow file, due to /usr/bin/lua being installed setuid to the itadmin account. This enables a BusyBox jailbreak attack.

The issue allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.