Maksim Rogov

**Name of the Vulnerable Software and Affected Versions** OpenBullet2 versions prior to 0.3.3 **Description** An authentication bypass exists in the API key authentication middleware. Unauthenticated attackers can gain administrative access to the admin console and all API endpoints by providing an empty value in the `X-Api-Key` header. This occurs because the middleware compares the supplied header against an empty `AdminApiKey` default string. **Recommendations** Update to a version newer than 0.3.2.

**Name of the Vulnerable Software and Affected Versions** OpenBullet2 versions prior to 0.3.3 **Description** A path traversal issue exists in the wordlist endpoint. Authenticated attackers can perform arbitrary file read, write, and delete operations by providing unsanitized absolute paths to the upload handler and wordlist functions. By manipulating critical system files such as `/etc/passwd`, these primitives can be chained to achieve remote code execution. The impact is severe because the application typically runs with root privileges. **Recommendations** Update OpenBullet2 to a version newer than 0.3.2. Restrict access to the wordlist endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenBullet2 versions prior to 0.3.3 **Description** Authenticated users can achieve remote code execution by uploading malicious script files with extensions such as .bat, .ps1, or .sh. This is possible through the FileProxySource proxy loading feature, which allows the server to execute these scripts and return the output as proxy lines, leading to arbitrary command execution on the host with the privileges of the process user. **Recommendations** Update to a version newer than 0.3.2. Restrict the use of the FileProxySource proxy loading feature as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** OpenBullet2 versions prior to 0.3.3 **Description** Authenticated users can execute arbitrary C# code on the server host by creating or modifying job configurations. This is possible because the plain C# execution mode does not implement reference filtering or API restrictions, allowing an attacker to access the file system, spawn processes, and invoke arbitrary .NET APIs with the privileges of the process user. **Recommendations** Update to a version newer than 0.3.2.

**Name of the Vulnerable Software and Affected Versions** OpenBullet2 versions prior to 0.3.3 **Description** On Windows, the application allows remote attackers to capture the NTLMv2 hash of the process user. This occurs when a job proxy source is configured with a UNC (Universal Naming Convention) path pointing to a server controlled by the attacker. When the job starts, the application attempts to load proxies from this path, triggering an SMB (Server Message Block) authentication attempt that discloses the NTLMv2 hash, which can then be relayed or cracked offline. **Recommendations** Update to a version newer than 0.3.2.