Mopmonk-Ai

**Name of the Vulnerable Software and Affected Versions** Apache APISIX versions 3.17.0 through 3.18.0 **Description** Cross-Site Request Forgery (CSRF) exists in the feishu-auth and dingtalk-auth plugins. An attacker can trick a user into clicking a crafted link, causing the user's browser session on a protected route to be established under the attacker's identity. Consequently, any actions performed by the user during that session, such as form submissions, uploads, or account bindings, will be associated with the attacker's account. **Recommendations** Upgrade to version 3.19.0.

**Name of the Vulnerable Software and Affected Versions** Apache Karaf versions prior to 4.4.12 Apache Karaf versions prior to 4.5.0 **Description** Apache Karaf contains a flaw in the `KarafMBeanServerGuard` which fails to enforce role-based access control (RBAC) on specific MBean lifecycle operations. The `createMBean()`, `registerMBean()`, and `unregisterMBean()` functions are not included in the guarded operations list, allowing any authenticated user, including those with the least-privileged "viewer" role, to instantiate arbitrary classes as MBeans without authorization or audit logs. This can be exploited to instantiate the `javax.management.loading.MLet` class, which serves as a remote classloader. By invoking the `getMBeansFromURL()` operation—which is permitted for the "viewer" role due to a wildcard rule matching "get*"—an attacker can fetch a remote MLet file and execute arbitrary code within the Karaf JVM. **Recommendations** Upgrade to version 4.4.12 or 4.5.0 or later. Restrict network access to the JMX RMI registry/server ports 1099 and 44444 to trusted hosts. Avoid issuing JMX credentials to any users who do not require the "admin" role.

**Name of the Vulnerable Software and Affected Versions** Apache Karaf (affected versions not specified) **Description** Missing authorization in the `jdbc` and `jms` shell command scopes allows authenticated users, including those with only the `viewer` role, to execute any `jdbc:*` and `jms:*` commands. This occurs because the command guard `SecuredSessionFactoryImpl` allows commands that lack a matching Access Control List (ACL) rule. Specifically, the `jdbc:ds-create` command allows the storage of an unvalidated, attacker-controlled JDBC URL into a `pax-jdbc-config` factory configuration, which is then converted into a live `DataSource`. Since some JDBC drivers execute code or SQL based on URL parameters, a user with `viewer` privileges can achieve arbitrary code execution, bypassing the administrative role requirements typically protecting `shell:exec`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.