Lucas Dodgson

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as `%2e` (representing a dot), to manipulate the URL portion following the top-level domain (TLD). This allows the redirection of users to a malicious domain if a similar registerable TLD exists. Additionally, the use of URL-encoded line feeds enables the insertion of arbitrary response headers in the server's HTTP response, a technique known as header injection. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The search functionality of the Webbox component allows unauthenticated users to provide a `pathnameroot` parameter containing Universal Naming Convention (UNC) paths. Because the server does not validate these paths, it attempts to establish outbound connections to arbitrary SMB servers. This behavior can lead to the exposure of NTLM authentication hashes, which attackers may use for credential theft or SMB relay attacks if outbound traffic on port 445 is permitted. **Recommendations** Update TeamDavid to a version later than Rollout 524. Restrict outbound connections on port 445 to prevent the server from connecting to unauthorized SMB endpoints.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application allows an unauthenticated attacker to create or modify files on the server using attacker-controlled content. This occurs because user input is written directly to files without adequate validation or restrictions on file types. An attacker can exploit this to create files, such as .htm files, containing malicious JavaScript, which leads to stored cross-site scripting (XSS) when a user accesses the created file. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application contains file upload functionalities susceptible to a buffer overflow. An unauthenticated attacker can cause a server crash and a subsequent denial of service by providing an excessively long filename during a file upload request. If the stack state allows or a stack canary is disclosed, this condition could lead to remote code execution and full server compromise. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** The Webbox application contains a buffer overflow condition in an API endpoint. An unauthenticated attacker can trigger a server crash and denial of service by submitting a specially crafted JSON body that is at least 8 characters long and starts with a number. Depending on the stack state or the disclosure of a stack canary (a security value used to detect buffer overflows), this condition could potentially allow remote code execution and full server compromise. **Recommendations** Update TeamDavid to a version later than Rollout 524.

**Name of the Vulnerable Software and Affected Versions** TeamDavid versions prior to Rollout 525 **Description** Tobit Laboratories AG TeamDavid's Webbox contains a flaw where a hard-coded cryptographic key is used. Passwords for users created locally in David are stored in multiple files using only obfuscation, which is a method of making data difficult for humans to read but does not provide strong security. An attacker with access to the server file system or the ability to extract files from the server can potentially retrieve these passwords. **Recommendations** Update TeamDavid to a version later than Rollout 524.