Pavan Nallamothu

The Flask application exposes the 'POST /script call/<script>' endpoint without authentication and utilizes wildcard Cross-Origin Resource Sharing (CORS), which allows requests from any origin. This configuration enables an attacker to use Cross-Site Request Forgery (CSRF) to force an operator's browser to execute arbitrary management commands. Examples of such commands include `control.py --wipe`, which permanently deletes forensic logs and captured network traffic, and `control.py --stop`, which disables security monitoring.

The Arkime live capture service (`arkime-live`) within Malcolm is configured with `network mode: host`, which exposes port 8005 across all network interfaces via `viewHost=0.0.0.0`. The service is configured to trust the `X-Forwarded-User` header from any IP address (`userAuthIps=::,0.0.0.0/0`) and automatically creates users with full access. Additionally, the `passwordSecret` is hardcoded to the public value "Malcolm". A network-adjacent attacker can bypass the nginx proxy by connecting directly to port 8005 using a forged identity header.

The file-upload component incorporates the FilePond PHP server, which includes an `index.php` file exposing a fetch API route. This route allows the server to download an arbitrary URL using curl with the FOLLOWLOCATION option enabled. When a HEAD request is made, the server stores the fetched response body in the upload container's transfer directory and returns a transfer ID, allowing the caller to read back the fetched content.