Mnqazi

Name of the Vulnerable Software and Affected Versions: python-multipart versions prior to 0.0.18 Description: The issue arises when parsing form data, as python-multipart skips line breaks in front of the first boundary and any tailing bytes after the last boundary, one byte at a time, emitting a log event each time. This can cause excessive logging for certain inputs. An attacker could exploit this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread. In the case of an ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service. Recommendations: For python-multipart versions prior to 0.0.18, update to version 0.0.18 to resolve the issue. As a temporary workaround, consider restricting the amount of data that can be sent before the first or after the last boundary to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kiwi TCMS versions prior to 12.5 **Description** The issue is related to the upload of attachments to test plans and test cases in Kiwi TCMS. Earlier versions of Kiwi TCMS had changes to serve all uploaded files as plain text to prevent browsers from executing potentially dangerous files. However, the previous Nginx configuration was incorrect, allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions, thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code required additional sanitation and improvements. The `tree view html()` function also needed sanitization of test plan names. **Recommendations** For versions prior to 12.5, update to version 12.5, which includes an updated Nginx content type configuration, improved file upload validation code, and sanitization of test plan names used in the `tree view html()` function. As a temporary workaround, consider restricting file uploads and access to potentially dangerous files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Kiwi TCMS versions prior to 12.4 **Description** The issue is related to the lack of protection of the web page structure in Kiwi TCMS, allowing a remote attacker to upload arbitrary attachments to test plans and test cases. Earlier versions of Kiwi TCMS had introduced upload validators and Content-Security-Policy definitions to prevent cross-site-scripting attacks, but the upload validation checks were not robust, leaving the possibility to circumvent them and upload potentially dangerous files. This allows the execution of arbitrary JavaScript in the browser. Additionally, Nginx's `proxy pass` directive can strip some headers, negating protections built into Kiwi TCMS when served behind a reverse proxy. **Recommendations** For versions prior to 12.4, upgrade to version 12.4 or later to address the issue. For users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy, make sure that additional header values are still passed to the client browser. If they aren't, redefine them inside the proxy configuration. As a temporary workaround, consider improving file upload validation code and updating Nginx reverse proxy configuration to prevent exploitation.