Oskar-Zeinomahmalat-Sonarsource

The file names constructed within file selector are missing sanitization checks, leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using their app and could potentially override internal files in their app cache.

The file names constructed within image picker are missing sanitization checks, leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using the app and could potentially override internal files in the app cache.

Name of the Vulnerable Software and Affected Versions: SnappyMail versions prior to 2.38.0 Description: SnappyMail is an open source web-based email client that uses the `cleanHtml()` function to cleanup HTML and CSS in emails. Research discovered that the function has bugs which cause an mXSS exploit, allowing a motivated attacker to inject JavaScript. However, due to the default Content Security Policy, the impact of the exploit is minimal. It could be possible to create an attack that leaks some data when loading images through the proxy, or to load a JavaScript attachment of the email. Recommendations: For versions prior to 2.38.0, users are advised to upgrade to version 2.38.0 or later. For older versions, an extension named "Security mXSS" can be installed as a mitigation, available at the administration area at `/?admin#/packages`. As a temporary workaround, consider disabling the `cleanHtml()` function until a patch is available. Restrict access to the vulnerable `cleanHtml()` function to minimize the risk of exploitation. Avoid using the `cleanHtml()` function in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playbook to read arbitrary files in the celery container, leading to sensitive information disclosure. The Celery container runs as root and has database access, allowing the attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. Recommendations: For JumpServer versions prior to 3.10.12, upgrade to version 3.10.12 or later. For JumpServer versions prior to 4.0.0, upgrade to version 4.0.0 or later. As a temporary workaround, consider restricting access to the Celery container to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: The issue is related to the JumpServer Privileged Access Management (PAM) tool, which provides secure access to various endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. Recommendations: For JumpServer versions prior to 3.10.12, upgrade to version 3.10.12 or later. For JumpServer versions prior to 4.0.0, upgrade to version 4.0.0 or later.

The @hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to version 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code, as code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request script to escape the sandbox.

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database.

The issue is related to insufficient input validation in JumpServer's Ansible, allowing remote attackers to bypass the input validation mechanism and execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database.

A flaw in the Core API of jumpserver allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. This enables attackers to make unlimited password attempts by altering their apparent IP address for each request.

The verification code for resetting a user's password in JumpServer is vulnerable to brute-force attacks due to the absence of rate limiting. This allows for up to 1,000,000 validation attempts within a 1-minute window. The issue is related to the 6-digit verification code sent to users to facilitate password reset.

The issue concerns the authentication procedure in JumpServer, an open source bastion host. An unauthenticated user can authenticate to the core API using a username and an SSH public key without needing a password or the corresponding SSH private key. This is possible because the API for the KoKo component to validate user private key logins does not verify the source of requests and will generate a personal authentication token. Given that public keys can be easily leaked, an attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions.

An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands.