Offensive-Ai

A missing authorization issue in the Image module allows forceful browsing, leading to information disclosure. The module fails to sufficiently check access to image style derivatives when files are served via a file stream other than `private://`. This issue occurs when Drupal is configured to use a contributed file scheme to serve private derived images.

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.

The WebAuthn prepare endpoint, `/api/webauthn/prepare`, in versions prior to 4.0.18 lacks authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create an unlimited number of user accounts, even when registration is disabled. The vulnerable parameter is not specified.

FreeScout, a PHP-based help desk and shared inbox application built on the Laravel framework, contains a flaw in its file upload restrictions. Prior to version 1.8.206, the application does not prevent the upload of `.htaccess` and `.user.ini` files. On Apache servers configured with `AllowOverride All`, an authenticated user can upload a `.htaccess` file, potentially redefining file processing rules and enabling Remote Code Execution. This issue can be exploited independently or in conjunction with another issue. The vulnerable file is located at `app/Misc/Helper.php`. The `upload` functionality is affected.

FreeScout’s `TokenAuth` middleware generates authentication tokens using a predictable method: `MD5(user id + created at + APP KEY)`. These tokens are static and do not expire or rotate. If an attacker obtains the `APP KEY` – a common exposure vector in Laravel applications – they can compute a valid token for any user, including the administrator, leading to full account takeover without requiring a password. The `user id` and `created at` are components used in the token generation.