Mariusz Maik

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network. SignalR connections are not consistently bound to the identity negotiated at connection establishment, which enables injected messages to execute Hub invocations as the victim.

Incorrect Access Control occurs because the application processes the `X-HTTP-Method-Override` header in the `ServeMux.ServeHTTP()` function without restricting allowed methods. When a POST request with `Content-Type` set to `application/x-www-form-urlencoded` includes this header, the request method is rewritten to an arbitrary value provided by the attacker before routing. This behavior enables the bypass of method-based access controls enforced by Web Application Firewalls (WAFs) or upstream proxies.

proCertum SmartSign parses external XML entities from crafted signature files, which enables Server-Side Request Forgery (SSRF) and potentially allows the reading of local files, depending on the parser's configuration. This XML External Entity (XXE) issue is triggered when a user previews a file in the file selection window, occurring before the file is actually opened.

The application opens the Certificate Practice Statement (CPS) URI without performing schema validation. This allows an attacker to create a certificate containing a CPS URI that points to a local executable file or an arbitrary URL. If a victim opens a document signed with this certificate, the application will execute the specified file or open the webpage.

SzafirHost is susceptible to remote code execution due to a discrepancy between how it verifies and extracts native library archives. The software uses a JarFile parser to verify the archive by reading the Central Directory, but employs a JarInputStream parser to extract libraries by reading sequentially from local file headers. An attacker can inject a malicious DLL, SO, or DYLIB as a local-file-header entry between the last legitimate entry and the Central Directory. Because this injected entry is not present in the Central Directory, the signature verifier accepts the archive as valid, while the extractor writes the malicious library to the native temporary directory without a hash check.

Insufficient input validation in the GitHub plugin API request handlers allows an authenticated attacker to cause a denial of service by crashing the plugin process. This is achieved by sending a crafted HTTP request to the 'PR details' endpoint.

SzafirHost verifies the signature of downloaded JAR files using the `JarInputStream` class, which reads from the beginning of the file, but loads classes using the `JarFile`/`URLClassLoader` classes, which read the Central Directory from the end. This discrepancy allows an attacker to combine a genuine, signed JAR file with a malicious ZIP file, bypassing verification to achieve remote code execution.

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions through 1.2.58 Description The UsersWP plugin for WordPress is susceptible to a blind Server-Side Request Forgery (SSRF). This is caused by inadequate URL origin validation within the `process image crop()` method during avatar/banner image crop operations. The function accepts a user-controlled URL via the `uwp crop` POST parameter and relies on `esc url()` for sanitization and `wp check filetype()` for extension verification, without ensuring the URL points to a local uploads file. The URL is then used in PHP image processing functions that support URL wrappers, allowing the WordPress server to make arbitrary HTTP requests to attacker-controlled or internal network destinations. This could enable internal network scanning and access to sensitive services for authenticated attackers with subscriber-level access or higher. Recommendations Update the UsersWP plugin to a version later than 1.2.58.

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to and including 8.8.3 Description The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is susceptible to authorization bypass. This occurs because the plugin’s AJAX handlers do not verify that the `b2s id` parameter, provided by the user, corresponds to the current user before executing UPDATE and DELETE operations. Authenticated attackers with Subscriber-level access or higher can exploit this to modify, reschedule, or delete scheduled social media posts belonging to other users. Recommendations Update Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress to a version later than 8.8.3.

The Blog2Social plugin for WordPress is susceptible to unauthorized data loss. The `resetSocialMetaTags()` function inadequately verifies user permissions, only checking for 'read' capability and a valid b2s security nonce. Because the plugin grants the 'blog2social access' capability to all roles upon activation, attackers with Subscriber-level access or higher can access the admin pages where the nonce is available. This allows them to delete all ` b2s post meta` records from the `wp postmeta` table, resulting in the permanent removal of custom social media meta tags for all posts on the site.

The Gallery by FooGallery plugin for WordPress has a flaw that allows unauthorized access to data. A missing capability check in the `ajax get gallery info()` function permits authenticated attackers with Subscriber-level access or higher to retrieve metadata—including the name, image count, and thumbnail URL—of private, draft, and password-protected galleries by enumerating gallery IDs.