Meifukun

The icon downloader fails to apply the `should block host()` check to the second-stage host when processing favicon URLs parsed from attacker-controlled HTML passed to `get page with referer()`. This allows a remote unauthenticated attacker to use an IP-literal URL in a favicon to bypass host normalization and force the server to reach loopback, private, or internal addresses. This issue occurs on instances where internal icon downloading is enabled and can lead to the exposure of internal responses or reveal internal network reachability through timing, status, and cache behavior.

Full API keys are written to application logs during every authenticated request. This allows individuals with access to the logs to recover and replay active bearer credentials, which are tokens used to authenticate a user's identity for a specific session.

An issue exists in the question operation controller where hide and show operations are gated using the incorrect permission check. Specifically, the system verifies the `question.unpin` permission instead of the `question.hide` permission. In custom role configurations where these permissions are separated, a user possessing only the `question.unpin` permission can hide or restore questions without having the required `question.hide` or `question.show` permissions.

An issue exists where the importer stores imported question bodies as raw HTML instead of using the standard Markdown-to-HTML sanitization path. This allows attacker-controlled HTML within an imported data source to be persisted and rendered to all viewers, including privileged users, resulting in stored Cross-site Scripting (XSS), which is a flaw where malicious scripts are injected into trusted websites.

Certain endpoints fail to enforce role-based authorization checks. This allows authenticated users to request these endpoints to read financial data that exceeds the permissions granted by their assigned role.

Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to send requests to these endpoints to modify data that exceeds the permissions granted by their assigned role.

Certain endpoints fail to enforce proper permission checks. This allows authenticated low-privileged users to request these endpoints directly to read financial data that exceeds the permissions of their assigned role.

An authorization bypass allows authenticated users to operate task instances in projects they are not authorized to access. This occurs through the following API endpoints: - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop' - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint'

An authorization bypass allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances across different projects. The system verifies permissions against the provided `projectCode` but does not confirm if the target resource actually belongs to that project. Consequently, a user with permissions in one project can use that project's code alongside a resource identifier from another project to bypass access restrictions. This allows attackers to alter workflow availability and interfere with task execution in unauthorized projects via the following endpoints: - 'POST /projects/{projectCode}/schedules/{id}/online' - 'POST /projects/{projectCode}/schedules/{id}/offline' - 'POST /projects/{projectCode}/workflow-definition/{code}/release'

An authorization flaw allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may enable users to authenticate directly to the Kubernetes API outside the application. Depending on the permissions of the disclosed credentials, such as cluster-admin or privileged service-account access, an attacker could read Kubernetes Secrets, create pods, and establish persistent access to the cluster.

The '/datasources/unauth-datasource' endpoint fails to properly enforce authorization for data sources. An authenticated user can call this endpoint to retrieve information about data sources they are not permitted to access, potentially exposing sensitive metadata and data source configurations.

Missing authentication for a critical function allows an unauthenticated remote attacker to persistently change a site-global configuration value regarding the frontpage weblog selection. This occurs because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. This issue can result in the redirection or disruption of the site's public frontpage.

An authorization bypass exists that allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog. This occurs through unscoped identifier-based lookups in multi-user installations where users should be isolated. Additionally, a user with administrator rights on their own weblog can overwrite the Velocity template of another weblog, which is then evaluated when the victim weblog renders. Velocity is a Java-based template engine used to generate dynamic content.

Improper restriction of XML External Entity (XXE) references allows a user with entry-editing rights on a weblog to force the server to parse a trackback response using an XML parser that does not disable external entity resolution. This can lead to the disclosure of files readable by the Roller process. Although the Trackback control is hidden in the standard UI, the action remains directly reachable without requiring any non-default server configuration.

An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller but fail to verify if the caller has the necessary permissions for the specific weblog or entry being accessed. This issue only affects installations where the non-default global XML-RPC setting is enabled.

Incorrect authorization in the OAuth 1.0a authorization endpoint allows an unauthenticated remote attacker to bind an outstanding request token for a configured site-wide consumer to an arbitrary user account, such as an administrator. This occurs because the endpoint derives the authorizing identity from a request-supplied value instead of the authenticated session. This issue only affects installations that configure an OAuth 1.0a site-wide consumer and requires the attacker to know an outstanding request token.

An authenticated user with entry-editing rights can trigger outbound HTTP requests to arbitrary destinations via legacy outbound Trackback and entry enclosure handling. Although the Trackback control is hidden in the standard UI, the action remains accessible. The issue occurs when an author provides an enclosure URL. Because the default Trackback allow-list is empty, it permits all destinations, including loopback and private-network addresses. Additionally, enclosure handling reveals the response status, content type, and length of the requested destination.

An authentication bypass exists due to a capture-replay flaw in the AtomPub API. An attacker can capture a valid WSSE digest authentication header and replay it to gain the authority of the victim. This occurs because the authentication process fails to enforce timestamp freshness or the uniqueness of the nonce (a random number used once to prevent replay attacks). This issue only affects installations where the non-default AtomPub API is enabled with WSSE authentication and plaintext-compatible password storage.

Cross-Site Request Forgery (CSRF) occurs when the CSRF validation filters accept requests that omit the required salt token, instead validating against a value generated by the server for that request. This allows a remote attacker to induce a logged-in author or administrator to visit a crafted page and perform state-changing actions under their authority. This issue does not require any optional features or non-default configurations.

Improper neutralization of input during web page generation leads to stored cross-site scripting (XSS) in the authoring UI. A user with authoring rights can store crafted content that is subsequently written into JavaScript string literals and markup sinks without proper encoding. This allows the stored script to execute in the browser of another author or administrator. This issue affects weblogs with multiple authors or administrators who are not mutually trusted and requires no optional features or non-default configurations.