Manus-Use

In the `forge.http` module, the ` trimString()` function in `lib/http.js` uses a regular expression to remove trailing whitespace from response header values and cookie names and values. This regular expression can take quadratic time when processing a long sequence of whitespace followed by a non-whitespace character. A malicious server or an on-path attacker can exploit this by providing a specially crafted response header, causing the `response.readHeader()` or `response.getCookies()` functions to repeatedly scan the input. This results in a Regular Expression Denial of Service (ReDoS), which blocks the Node.js event loop or the browser tab for several minutes. This issue specifically affects applications using `forge.http` with a socket pool to communicate with untrusted servers.

A `forge.tls` client can trigger an uncaught `TypeError` within the `connection.process()` function when it receives a handshake record while no session is active. This occurs if a record is received before `handshake()` is called, after the application calls `close()`, or following a `close notify` alert. The issue stems from the `tls.handleHandshake()` function attempting to dereference `c.session.md5` before dispatching the message. A malicious server or an on-path attacker can deliver such a record to terminate a Node.js process if the application does not catch the resulting exception. This issue does not impact confidentiality or integrity, and `forge.tls` servers are not affected.

An issue allows unauthenticated attackers to cause a denial of service by sending serialized Java data without size or structure limits, leading to server resource exhaustion. Attackers can send crafted requests to remote SDK endpoints, classic login pages, or the administration console to block session validation, authentication, and policy decisions.

A credential disclosure issue exists in the `gix-fs` component. Remote attackers can capture NTLM credentials by providing UNC symlink targets within a crafted repository. On Windows systems with symlinks enabled, the `gix fs::symlink::create()` function calls `is dir()` on the UNC target, which triggers SMB authentication and leaks the username, domain, and NTLMv2 hash.

An account enumeration issue exists in the unauthenticated POST '/api/webauthn/prepare-login' endpoint. The system returns stable stored credential IDs for accounts registered with passkeys, while returning a fallback ID derived from `md5(time())` for others. Because there is no rate limiting, unauthenticated attackers can compare `allowCredentials` IDs from requests sent more than one second apart to identify existing passkey-registered accounts and their associated credential IDs.

An issue exists where parties registering UMA resource sets can trigger internal requests via unvalidated scope description URLs. This occurs because the system fetches these URLs when sending pending-request notification emails. An attacker can provide URLs pointing to internal hosts or cloud metadata endpoints to perform internal network probing. Server-side request forgery (SSRF) is a flaw where a server is tricked into making requests to an unintended location.

An issue exists in the FaxSMS module's `disposeDocument()` functions within `RCFaxClient` and `SignalWireClient`. Authenticated users with low privileges can perform path traversal—a method used to access files and directories that are stored outside the web root folder—by manipulating the unsanitized `file path` parameter. By requesting `action=download`, an attacker can retrieve sensitive cleartext files, such as `sqlconf.php` containing database credentials and keys. Alternatively, using `action=setup` allows the overwriting of files writable by the web server with ciphertext.

Administrators, including delegated realm administrators, can trigger a server-side request forgery (SSRF) by providing arbitrary URLs through the federation configuration wizard metadata URLs. This allows the server to fetch content from internal hosts or cloud metadata endpoints, enabling the probing of internal networks and the reading of partial responses. This occurs when metadata or OpenID Connect discovery URLs are processed.

Authenticated users can cause a denial of service by exhausting API process memory during the upload of WeKan or vikunja-file imports due to the absence of an item-count cap. By submitting a WeKan JSON file of approximately 22 MB containing duplicate IDs or hundreds of thousands of cards to the 'wekan migrate' endpoint, an attacker can trigger an Out of Memory (OOM) condition, which crashes the instance.

The Trello, Todoist, and Microsoft To Do migration importers allocate memory without limits. This occurs because remote attachment downloads and API responses are buffered in memory without size caps. An authenticated user can trigger a migration that references oversized API responses or huge attachments served by an attacker, leading to memory exhaustion and crashing the shared API process for all tenants.

A stored cross-site scripting issue exists where privileged attackers can inject scripts by placing markup in a user's display name. The script executes when a victim accesses the OAuth 2.0 / OpenID Connect consent page, potentially allowing the attacker to steal the OpenAM session cookie and impersonate the user.

The software fails to enforce Proof Key for Code Exchange (PKCE), a security extension for OAuth 2.0, in the device authorization flow. Specifically, the system does not validate the code verifier during the exchange of device codes for tokens. This allows an attacker who obtains an approved device code from shared device storage or client logs to redeem it for ID and access tokens, enabling user impersonation.

Insufficient validation of responses on the internal server-to-server SOAP channel allows network-positioned attackers to compromise integrity and availability. Attackers who control a site server or intercept unencrypted traffic can crash receiving processes, tamper with writable files, and potentially execute arbitrary code.

When the redirect interceptor and a shared response cache are used together, an authenticated request redirected to a same-origin target stores the final response under the original request's cache key. Because this key omits credentials and lacks a Vary header, subsequent requests from anonymous or different users may be served the private response body of the first user, leading to cross-user disclosure of cached private responses.

An issue exists in the HTTP client where the cache interceptor, when used with a downstream handler that throws during response processing, allows an asynchronous throw to escape as an uncaught exception or unhandled promise rejection. This occurs during the replay of a cached response, which terminates the Node.js process. A malicious or compromised HTTP server can trigger this by serving a cacheable response that causes a throw on replay, such as during a 304 revalidation of a stale entry, impacting system availability. Examples of handlers that may trigger this include the dump interceptor exceeding its `maxSize` or the decompress interceptor rejecting more than five Content-Encoding values.

Namespace-scoped tenants can achieve privilege escalation by modifying resources in other namespaces. This occurs because the `targetMatchConstraints.expression` within the NamespacedMutatingPolicy lacks proper namespace checks in its Common Expression Language (CEL) output. An attacker can specify a literal target, such as another tenant's RoleBinding, which the cluster-wide background controller then mutates to add attacker subjects or alter Roles, NetworkPolicies, and ConfigMaps.

An authorization bypass allows namespace tenants to overwrite resources in other namespaces. This occurs via the `NamespacedMutatingPolicy` `mutate-existing` `targetMatchConstraints.expression`. An attacker can return a CEL (Common Expression Language) map literal to fabricate a target with a chosen `metadata.namespace`, which leads the privileged background controller to overwrite Secrets, Deployments, or policies across the cluster.

A denial of service issue exists where remote attackers can exhaust CPU resources through quadratic-time emphasis delimiter processing. By submitting small markdown documents containing repeated patterns such as "*a b", an O(n²) index-fixup loop is triggered, which can stall workers for several seconds.

An authorization bypass allows authenticated customers to create MySQL databases by calling the 'Mysqls.add' API endpoint. This occurs because the endpoint lacks the `customer hide options` check, enabling users to create databases within their own quota even if the administrator has disabled the MySQL feature.

Station users with Profile permission can execute operating system commands through StereoTool settings. This occurs when shell metacharacters are injected into the `stereo tool configuration path` or `stereo tool license key` variables, which are then executed via /bin/sh during a station restart, leading to a compromise of the container.