Paul-Gerste-Sonarsource

An unauthenticated arbitrary file read is possible via ffmpeg argument injection through the query parameter parsing mechanism. The `ParseStreamOptions` method in `StreamingHelpers.cs` adds lowercase query parameters to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter. This unsanitized value is then concatenated directly into the ffmpeg command line. An attacker can inject a drawtext filter with a textfile argument to read arbitrary server files, such as /etc/shadow, and exfiltrate the contents as text rendered in the video stream response. The affected endpoint is '/Videos/{itemId}/stream', which lacks an Authorize attribute, allowing exploitation without authentication, although item GUIDs are pseudorandom.

Name of the Vulnerable Software and Affected Versions: Komga versions 1.8.0 through 1.21.3 Description: A Cross-Site Scripting (XSS) issue has been found in Komga when serving EPUB resources. This allows an attacker to perform actions on the victim's behalf. If an admin user is targeted, it can be combined with server-side command control to achieve arbitrary code execution. The issue requires a malicious EPUB file to be present in a Komga library and accessed by an admin user in the Epub reader. Recommendations: For versions 1.8.0 through 1.21.3, update to version 1.22.0 to resolve the issue. As a temporary workaround, consider restricting access to the EPUB reader for admin users until the update is applied. Avoid accessing malicious EPUB files in the Epub reader to minimize the risk of exploitation.

The issue is related to a Zip Slip vulnerability in the E.D.D.I middleware, which connects and manages LLM API bots. An attacker with access to the "/backup/import" API endpoint can write arbitrary files to locations outside the intended extraction directory. Although the application runs as a non-root user, limiting direct impact on system-level files, this vulnerability can still be exploited to overwrite application files, such as JAR libraries, owned by the application user. This overwrite can potentially lead to Remote Code Execution (RCE) within the application's context.

The `WriteBind()` method in `src/Npgsql/Internal/NpgsqlConnector.FrontendMessages.cs` uses `int` variables to store the message length and the sum of parameter lengths. Both variables overflow when the sum of parameter lengths becomes too large. This causes Npgsql to write a message size that is too small when constructing a Postgres protocol message to send it over the network to the database. When parsing the message, the database will only read a small number of bytes and treat any following bytes as new messages while they belong to the old message. Attackers can abuse this to inject arbitrary Postgres protocol messages into the connection, leading to the execution of arbitrary SQL statements on the application's behalf.

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

The issue is related to SQL injection in the pgx PostgreSQL driver and toolkit for Go. It occurs when the non-default simple protocol is used, a placeholder for a numeric value is immediately preceded by a minus, there is a second placeholder for a string value after the first placeholder on the same line, and both parameter values are user-controlled. This allows an attacker to execute arbitrary SQL queries.

The issue allows for SQL injection when using the non-default connection property `preferQueryMode=simple` in combination with application code that has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. The `preferQueryMode` property is not a supported parameter in the Redshift JDBC driver and is inherited code from the Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected.

The PostgreSQL JDBC Driver has a SQL injection vulnerability when using the PreferQueryMode=SIMPLE connection property. This allows an attacker to inject SQL and alter queries, bypassing protections against SQL injection attacks. The vulnerability requires specific conditions to be met, including a placeholder for a numeric value immediately preceded by a minus and a second placeholder for a string value on the same line. Both parameters must be user-controlled. The vulnerability can be exploited to expose assets and has a high impact on confidentiality, integrity, and availability.

The issue allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL, which may be realistic within enterprise security products.

The issue is related to the handling of untrusted `Gemfile`'s in bundler. When a `Gemfile` includes `gem` entries with the `git` option and invalid values starting with a dash, it can lead to Code Execution. This happens because bundler uses commands like `git clone` and constructs them using user input, which can be interpreted as optional arguments instead of positional ones. An attacker can exploit this by crafting a directory with a `Gemfile` that declares a dependency in a Git repository with a Git URL in the form of `-u./payload`. This can lead to Arbitrary Code Execution, potentially allowing the takeover of the system. However, the exploitability is low due to the requirement of significant user interaction.