Mopmonk Ai

Code injection in the ModelFormField of the cms plugin allows a remote authenticated attacker with CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user. This occurs via a single HTTP POST request to the 'EditAddContent' endpoint by submitting a crafted `caContentIdTo` parameter. The CMS screen copies this parameter into a top-level context variable that is interpolated into a form field's use-when attribute, and the resulting string is passed unvalidated to the `GroovyUtil.eval()` function. The compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, enabling a payload to close the expanded string literal and invoke java.lang.Runtime via reflection.

Apache Allura contains a flaw where OAuth1 callback validation is missing. This occurs when the system fails to properly verify the callback URL during the OAuth1 authentication process, which could allow an attacker to redirect users to a malicious site.

A missing authorization issue exists in the `query-dynamic-sub-workflows` API. The API fails to properly verify if an authenticated user has the necessary permissions to access the workflows being queried. Consequently, an authenticated user can invoke the API using parameters that reference workflows from a project they are not authorized to access, leading to unauthorized disclosure of workflow information.

Improper verification of cryptographic signatures occurs when Secure Remote Access (SRA) is configured for OAuth 2.0 without a JWKS set URI assigned. This flaw allows an attacker to forge arbitrary JSON Web Tokens (JWTs) to impersonate any user identity and permissions, granting full access to services proxied by SRA.

An LDAP Injection occurs due to improper neutralization of special elements used in an LDAP query. This allows a caller with valid credentials for one LDAP directory entry to authenticate through APISIX as a consumer mapped to a different entry, bypassing the restrictions intended by the plugin's configured scope.