Kocaemre

An issue exists where user-controlled sorting fields and `filter aliases` attribute paths are directly interpolated into ArangoDB AQL identifier and expression positions within `core/database arango.py`. A low-privileged authenticated user can exploit this by sending crafted values to the following API endpoints: - '/api/v2/observables/search' - '/api/v2/entities/search' - '/api/v2/indicators/search' - '/api/v2/dfiq/search' - '/api/v2/search/' - '/api/v2/graph/search' This allows attacker-controlled AQL subexpressions to be parsed and evaluated, which can lead to the use of an error oracle, evaluation of expressions against internal collections like users, alteration of search logic, enumeration of schema information, and excessive consumption of database resources. The issue is limited to read and search contexts, meaning arbitrary database writes are not possible.

A low-privileged authenticated user can exploit a path traversal issue by importing a DFIQ object with a `uuid` containing traversal sequences via the 'POST /api/v2/dfiq/from yaml' endpoint. The system subsequently interpolates this stored value into an archive filesystem path through the 'POST /api/v2/dfiq/to archive' endpoint. This allows an attacker to write controlled content with a .yaml suffix outside the intended temporary archive directory, limited to paths writable by the YETI service account.

An issue exists where the software derives `ExportTask.file name` from a user-controlled task name and passes it to `core/clients/file storage/classes/local storage.py` without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user utilizing the default local storage backend can exploit this via the 'POST /api/v2/tasks/export/new' endpoint by providing a traversal name. Subsequently, the user can read files accessible to the service account through the 'GET /api/v2/tasks/export/{export id}/content' endpoint. Additionally, executing the `ExportTask.run()` function allows writing attacker-controlled export output to a selected writable path. The overall impact is determined by the filesystem permissions of the service account.

Missing authorization in `GatewayServiceResource` allows authenticated users without an administrative role to manage gateway tunnels. By sending POST or DELETE requests to the gateway tunnel endpoint, an attacker can establish persistent bidirectional TCP circuits into an edge gateway network or terminate existing operator tunnels.

An authenticated user with permissions to manage groups and request reports can create a cyclic group-parent hierarchy. When a trips or stops report is requested for a device within this hierarchy, the `org.traccar.api.resource.GroupResource` allows the cycle, and the `org.traccar.helper.model.AttributeUtil.lookup()` function follows group parents without cycle detection, a visited set, or a depth limit. This process, accessed via `TripsConfig.` and `ReportUtils.slowTripsAndStops`, results in a non-terminating storage-backed lookup that consumes high CPU on a Jetty worker and can exhaust the web/API worker pool if requests are repeated.

A malicious or man-in-the-middle enrollment manager can cause a denial of service by crashing a Wazuh agent during the enrollment process. This occurs when the manager returns a malformed key response containing fewer than four fields, leading to a NULL pointer dereference. The `w enrollment process agent key()` routine splits the key into four space-separated fields but fails to verify their presence before validation. Specifically, `OS StrBreak()` leaves missing trailing entries as NULL, and `OS IsValidName()` subsequently calls `strlen()` on the NULL argument, terminating the agent process. This is possible when enrollment is permitted against an unverified manager due to the absence of a configured CA certificate.

A null pointer dereference occurs in the `inventory sync` FlatBuffer DataValue handling. An enrolled agent can trigger a denial of service by sending a verifier-valid DataValue message that omits the optional `id` field. This causes the `wazuh-modulesd` process to crash when it attempts to dereference `data->id()->string view()` without performing null validation.

A flaw in the permission splitter logic fails to conservatively split or reject certain Bash shell constructs that create command-execution boundaries or nested execution. This improper input validation and parsing of shell syntax allows a permitted prefix, such as 'git', to mask an additional command. Consequently, the `rtk rewrite` function returns exit code 0, leading the Claude hook to emit a permissionDecision of "allow". This enables the hidden command to execute without the user confirmation or denial intended by the permission rules, potentially leading to unauthorized command execution under the user's context.

An authenticated, non-readonly user can exploit a flaw when submitting requests to the 'DELETE /api/permissions' endpoint. The `Permission(LinkedHashMap<String, Long>)` function in `src/main/java/org/traccar/model/Permission.java` only validates the first two keys of the provided JSON, while the `DatabaseStorage.removePermission()` function in `src/main/java/org/traccar/storage/DatabaseStorage.java` concatenates all map keys into the SQL WHERE clause as column identifiers. This allows an attacker to inject controlled SQL via an extra JSON key, creating a blind boolean or error oracle. This can be used to extract sensitive database values, such as administrator emails, password hashes, and salts, or to conditionally delete permission rows.