Mattia Campanelli

An improper authorization issue exists where any authenticated user can reject arbitrary pending edit-revisions. This occurs because the system lacks an authorization check during the reject operation, allowing users to perform this action without the required review permissions.

The issue allows for SQL Injection vulnerabilities in the "dwr/call/plaincall/workflow.runWorkflowRule.dwr" endpoint. Through the injection of arbitrary SQL statements, a potential attacker can modify query syntax and perform unauthorized operations against the remote database.

A cross-site scripting (XSS) issue was discovered. The Web Application does not properly check parameters sent in a "/dvcset/sysset/set.cgi" POST request via the `arg01.Hostname` field before saving them on the server. The JavaScript malicious content is then reflected back to the end user and executed by the web browser.

The Web Application is affected by a Denial of Service issue. An unauthenticated attacker can send POST requests to the "/download/set.cgi" page by manipulating the `failhtmfile` variable, causing interruption of the service provided by the Web Application.

Name of the Vulnerable Software and Affected Versions: Thruk versions prior to 2.44 Description: The issue allows for stored XSS, potentially enabling attackers to inject malicious scripts into the application. This could lead to unauthorized access or control of user sessions. Recommendations: For versions prior to 2.44, update to version 2.44 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive features or input fields to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Thruk versions 2.40 through 2 Description: The issue allows for Reflected XSS via the `host` or `title` parameter in the "/thruk/#cgi-bin/status.cgi" endpoint. An attacker could inject arbitrary JavaScript into status.cgi, which would be triggered every time an authenticated user browses the page containing it. Recommendations: For Thruk versions 2.40 through 2, as a temporary workaround, consider restricting access to the "/thruk/#cgi-bin/status.cgi" endpoint until a patch is available. Avoid using the `host` or `title` parameters in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Thruk versions 2.40-2 Description: The issue allows for Reflected XSS via the `host` or `service` parameter in the `/thruk/#cgi-bin/extinfo.cgi` API endpoint. An attacker could inject arbitrary JavaScript into extinfo.cgi, and the malicious payload would be triggered every time an authenticated user browses the page containing it. Recommendations: For Thruk versions 2.40-2, consider disabling access to the `/thruk/#cgi-bin/extinfo.cgi` API endpoint until a patch is available. Restrict the use of the `host` and `service` parameters to minimize the risk of exploitation.

The issue occurs in the /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr endpoint because the data received as input from clients is re-included within the HTTP response returned by the application without adequate validation. If HTML code or client-side executable code (e.g., Javascript) is entered as input, the expected execution flow could be altered.

The issue arises from the software's failure to properly validate requests for access to data and functionality in several affected endpoints: "/archibus/schema/ab-edit-users.axvw", "/archibus/schema/ab-data-dictionary-table.axvw", "/archibus/schema/ab-schema-add-field.axvw", and "/archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw". This allows any authenticated user to access pages not intended for them, including the administrative console for user management, by directly requesting access via URL. A malicious user can exploit this to modify all users' profiles, elevate privileges to administrative levels, create or delete any type of user, and even modify other users' emails through a misconfiguration of the `username` parameter on the user profile page.

The issue arises from the Web Application in /archibus/login.axvw, where a session token could be assigned that is already in use by another user. This allowed access to the application without knowing the user's credentials. It was also possible to set the value of the session token client-side by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the `JSESSIONID` field. The application did not assign a new token after login, continuing to use the inserted one as the session identifier. This vulnerability only affects products that are no longer supported by the maintainer.