Proscan-One

A missing authorization issue exists in the customer address API, allowing unauthenticated attackers to manage addresses belonging to other customers. Attackers possessing the `customer id` and address UUIDs can perform unauthorized actions by sending POST, PATCH, or DELETE requests to the '/api/customers/:customer id/addresses' endpoint to add, modify, or delete saved shipping addresses.

The shared-view password check used strict-equality (===) comparison for legacy plaintext passwords. This creates a timing oracle, allowing a network-positioned attacker to leak the password length and per-character prefix by analyzing response timing. The issue occurs in the `View.ts` file and the `verifyPassword()` function of the EE dashboard model. The bcrypt branch, which handles hashes starting with `$2a$` or `$2b$`, is not affected.

An issue exists in the LDAP identity provider implementation where user-provided usernames are not properly escaped before being included in LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process. By using LDAP metacharacters such as `*`, `(`, and `)`, an attacker can execute blind LDAP injection. This technique enables the systematic enumeration of valid usernames and the extraction of sensitive attribute data from the connected LDAP directory by analyzing the success or failure responses. This does not allow for a full authentication bypass.

Multiple issues allow for code execution. Three unsafe `unserialize()` calls within `SchedulerJobQueue`, `FrameworkCacheAdapterFileCache`, and `Session` deserialize untrusted data without restricting allowed classes. This enables PHP object injection which, through a gadget chain, allows arbitrary code execution when an attacker controls the serialized input. Additionally, the `InstallCommand` function performs a git clone operation that passes the `branch`, `url`, and `path` parameters into a shell command without escaping, leading to OS command injection during plugin or theme installation for users with admin access. A server-side template injection is also possible via a Twig security blocklist bypass.

Portainer includes a security setting to disable bind mounts for non-administrators, intended to prevent regular users from binding host paths into containers via the Portainer-mediated Docker API. However, the enforcement mechanism only inspected the `HostConfig.Binds` array and ignored the equivalent `HostConfig.Mounts` array. Since both fields are interchangeable on the Docker daemon, an authenticated user with container-creation rights can bypass this restriction by submitting a `bind`-typed entry under `HostConfig.Mounts` at the 'POST /containers/create' endpoint. This allows the user to mount any host path into their container, potentially gaining read or write access to the host filesystem as the Docker daemon user (typically `root`). This can lead to the exposure of sensitive files, compromise of other containers on the same host, or full Docker API access if the Docker socket is mounted.