Ninjagpt

A race condition exists in `users.service.ts`. This issue allows an individual with a valid reset token to execute multiple password changes by submitting concurrent reset requests. The flaw occurs because the slow bcrypt hashing process creates a time window before the token is invalidated, enabling an attacker to overwrite the new password set by the owner and lock them out of the account.

The software contains a cross-site request forgery issue in its GraphQL endpoint. Attackers can exploit GET-based query requests to perform unauthorized actions against privileged users by manipulating GraphQL query parameters. The ''GraphQL endpoint'' is susceptible to malicious GET requests.

Name of the Vulnerable Software and Affected Versions: Stirling-PDF versions prior to 1.1.0 Description: Stirling-PDF is a locally hosted web application used for PDF file operations. Prior to version 1.1.0, the application is susceptible to Server-Side Request Forgery (SSRF) when converting HTML to PDF using the `/api/v1/convert/html/pdf` endpoint. This occurs because the security sanitizer used during HTML processing can be bypassed, allowing unauthorized requests to external resources. The backend utilizes a third-party tool for this conversion process. Recommendations: Upgrade to version 1.1.0 or later.

Name of the Vulnerable Software and Affected Versions: Stirling-PDF versions prior to 1.1.0 Description: Stirling-PDF is a locally hosted web application used for PDF file operations. The “convert file to pdf” functionality, accessible via the `/api/v1/convert/file/pdf` API endpoint, is susceptible to Server-Side Request Forgery (SSRF) during the file conversion process. This occurs because the application utilizes LibreOffice’s unoconvert tool for conversion. Recommendations: Upgrade to version 1.1.0 or later.

Name of the Vulnerable Software and Affected Versions: Stirling-PDF versions prior to 1.1.0 Description: Stirling-PDF is a locally hosted web application used for PDF file operations. Prior to version 1.1.0, the application is susceptible to Server-Side Request Forgery (SSRF) when utilizing the `/api/v1/convert/markdown/pdf` endpoint to convert Markdown to PDF. The backend's security sanitizer can be bypassed, leading to the SSRF condition. Recommendations: Upgrade to Stirling-PDF version 1.1.0 or later.