Lucas Dodgson

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as `%2e` (representing a dot), to manipulate the URL portion following the top-level domain (TLD). This allows the redirection of users to a malicious domain if a similar registerable TLD exists. Additionally, the use of URL-encoded line feeds enables the insertion of arbitrary response headers in the server's HTTP response, a technique known as header injection.

The search functionality of the Webbox component allows unauthenticated users to provide a `pathnameroot` parameter containing Universal Naming Convention (UNC) paths. Because the server does not validate these paths, it attempts to establish outbound connections to arbitrary SMB servers. This behavior can lead to the exposure of NTLM authentication hashes, which attackers may use for credential theft or SMB relay attacks if outbound traffic on port 445 is permitted.

The Webbox application allows an unauthenticated attacker to create or modify files on the server using attacker-controlled content. This occurs because user input is written directly to files without adequate validation or restrictions on file types. An attacker can exploit this to create files, such as .htm files, containing malicious JavaScript, which leads to stored cross-site scripting (XSS) when a user accesses the created file.

The Webbox application contains file upload functionalities susceptible to a buffer overflow. An unauthenticated attacker can cause a server crash and a subsequent denial of service by providing an excessively long filename during a file upload request. If the stack state allows or a stack canary is disclosed, this condition could lead to remote code execution and full server compromise.

The Webbox application contains a buffer overflow condition in an API endpoint. An unauthenticated attacker can trigger a server crash and denial of service by submitting a specially crafted JSON body that is at least 8 characters long and starts with a number. Depending on the stack state or the disclosure of a stack canary (a security value used to detect buffer overflows), this condition could potentially allow remote code execution and full server compromise.

Tobit Laboratories AG TeamDavid's Webbox contains a flaw where a hard-coded cryptographic key is used. Passwords for users created locally in David are stored in multiple files using only obfuscation, which is a method of making data difficult for humans to read but does not provide strong security. An attacker with access to the server file system or the ability to extract files from the server can potentially retrieve these passwords.