Q1Uf3Ng

When a JWT access method is configured using the `ALGORITHM ES512` parameter within the `DEFINE ACCESS` statement, the system silently substitutes the ES384 algorithm. This occurs because the underlying `jsonwebtoken` crate (v10.x) lacks an ES512 variant, causing the mapping to default to ES384 without generating errors, warnings, or log messages. Consequently, users providing a P-521 key for ES512 encounter authentication handshake failures due to a curve mismatch, as ES384 requires a P-384 curve. Additionally, tokens generated are rejected by external systems expecting genuine ES512 signatures. This issue does not allow for token forgery or compromise of data confidentiality and integrity.

An issue exists in the `FieldsController::actionRenderCardPreview()` method where the `fieldLayoutConfig` POST parameter is passed directly to `Fields::createLayout()` without being processed by `Component::cleanseConfig()`. This lack of sanitization allows an authenticated admin user to inject Yii2 event handlers, such as `on init` keys, via the `fieldLayoutConfig` parameter. This can lead to the execution of arbitrary PHP code and the disclosure of sensitive information, including the `CRAFT SECURITY KEY` and environment variables containing database credentials.

The ` safe eval expression()` function in the computed fields feature uses an AST (Abstract Syntax Tree) validator that only blocks attributes starting with an underscore. Because Python generator and frame object attributes such as `gi frame`, `f back`, and `f builtins` do not start with an underscore, they can be used to escape the sandbox and achieve arbitrary code execution. An unauthenticated attacker can trigger this by sending a 'POST /crawl' request with a crafted `JsonCssExtractionStrategy` schema containing a malicious computed field expression. This allows the attacker to access the frame chain, reach `f builtins` to import the `os` module, and execute arbitrary system commands inside the Docker container, potentially leading to file system access and secret exfiltration.

The WebSocket upgrader for the '/exec' and '/attach' endpoints accepts upgrade requests from any origin because it uses a custom `CheckOrigin` function that always returns true. When combined with the JWT cookie using `SameSite: Lax`, this allows Cross-Site WebSocket Hijacking (CSWSH). An attacker hosting a page on a same-site origin (such as a sibling subdomain or another service on localhost) can initiate a WebSocket connection to the exec endpoint. This connection carries the victim's valid JWT cookie, allowing the attacker to gain interactive shell access to any container the victim is authorized to access.

Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The 'extractArchive' and 'compressFiles' endpoints in file-manager.ts use double-quoted strings for shell command construction. This implementation allows $(command) substitution, which enables command injection on the remote SSH host.

The '/add/' endpoint (AddView in `core/views.py`) allows the injection of arbitrary configuration into crawl jobs because the config JSON field is merged without validation. This configuration is subsequently exported as environment variables when archive plugins run, enabling the injection of tool arguments to achieve remote code execution. When the `PUBLIC ADD VIEW` variable is set to True, this can be exploited without authentication, as the endpoint is also `@csrf exempt` (exempt from Cross-Site Request Forgery protection, a mechanism that prevents unauthorized commands from being transmitted from a user the web application trusts). Specifically, the `config` parameter can be used to override keys such as `YTDLP ARGS EXTRA` or `GALLERYDL ARGS EXTRA` to execute arbitrary commands via the `--exec` flag of the respective tools.

An OS command injection issue exists in the `:find` command-line completion. When the `path` option contains shell commands enclosed in backticks, these commands are executed during file name completion. Since the `path` option lacks the `P SECURE` flag, it can be modified via a modeline. This allows an attacker who controls a file's content to execute arbitrary shell commands if a user opens that file and triggers the `:find` completion.

Gotenberg, an API for converting document formats, contains a flaw related to URL scheme handling. A previously implemented fix for CVE-2024-21527 could be bypassed by utilizing mixed-case or uppercase URL schemes, such as `FILE:///etc/passwd` or `File:///etc/passwd`. The issue stems from a case-sensitive regular expression used in the `FilterDeadline` function within `pkg/gotenberg/filter.go`, which does not account for the case-insensitivity of URI schemes as defined in RFC 3986 Section 3.1. This allows attackers to bypass the intended security measures and potentially read arbitrary files from the Gotenberg container. The vulnerability affects both the URL endpoint and HTML conversion processes, including those involving iframes and link tags. The vulnerable code resides in `pkg/modules/chromium/chromium.go`, `pkg/gotenberg/filter.go`, and `pkg/modules/chromium/events.go`. The API endpoint ''/forms/chromium/convert/url'' is affected, utilizing the `url` parameter.

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. Before version 2.17.0, the `str eval()` function within the `notification handler.py` file implemented a sandboxed `eval()` function for notification text templates. The sandbox aimed to restrict callable names by inspecting `code.co names` of the compiled code object. However, `code.co names` only contains names from the outer code object. When a lambda expression was used, it created a nested code object, and attribute accesses were stored in `code.co consts`, not `code.co names`. Consequently, the sandbox did not inspect nested code objects.

An authorization bypass allows any authenticated user to access deployment details belonging to any team. The issue occurs because the `GET /api/v1/deployments/{uuid}` endpoint fails to use the `$teamId` extracted from the authentication token to scope the database query.

An issue exists where the `ws std image sql filter()` function fails to perform escaping or type validation on four date filter parameters: `f min date available`, `f max date available`, `f min date created`, and `f max date created`. These parameters are concatenated directly into SQL queries, allowing an unauthenticated attacker to read the entire database, including user password hashes.

The `DomainZones.add` API endpoint, accessible to customers with DNS enabled, does not validate the `content` field for specific DNS record types (LOC, RP, SSHFP, TLSA). This allows an attacker to inject newlines and BIND zone file directives, such as `$INCLUDE`, into the zone file. When the DNS rebuild cron job runs, the modified zone file is written to disk. This can lead to information disclosure, DNS service disruption, and potential zone data manipulation. The vulnerable code resides in `lib/Froxlor/Api/Commands/DomainZones.php` (lines 213-214, 253-254, 290-291, 292-293) and `lib/Froxlor/Dns/DnsEntry.php` (line 83), and the zone file is written in `lib/Froxlor/Cron/Dns/Bind.php` (line 121). An example of exploitation involves using the `curl` command with the `DomainZones.add` command and injecting BIND directives into the `content` parameter of a LOC record. The API endpoint is ''/api.php'' and the vulnerable parameter is `content`.

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `field function` parameter received through POST data in the AOR Reports module is saved directly into the `aor fields` table without validation. Subsequently, when a report is executed or viewed, this value is directly concatenated into a SQL SELECT query without sanitization, leading to a second-order SQL injection. An authenticated user with Reports access can potentially extract arbitrary database contents, including password hashes, API tokens, and configuration values. In MySQL environments with FILE privilege, Remote Code Execution (RCE) may be possible through SELECT INTO OUTFILE.

An issue exists in the `ConfigWriter::cleanUpString()` function that fails to sanitize Liquidsoap string interpolation sequences. Authenticated users with Media or Profile permissions can exploit this by injecting arbitrary Liquidsoap code into station configuration. Specifically, by inserting `#{process.run()}` expressions into playlist URLs or station metadata fields, an attacker can execute shell commands as the azuracast user upon station restart.

Chartbrew is a web application that connects to databases and APIs to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against connected databases, specifically MySQL and PostgreSQL. This allows an attacker to potentially read, modify, or delete data within those databases, depending on the privileges of the database user. The vulnerable code involves the handling of date-type variables within the `applyMysqlOrPostgresVariables` function.

OpenReplay is a self-hosted session replay suite. The `/{projectId}/cards/search` API endpoint has a SQL injection issue in the `sort.field` parameter for versions before 1.20.0. The issue allows for potential unauthorized database access or modification through manipulation of the `sort.field` parameter in the specified API endpoint.

BentoML, a Python library used for building online serving systems for AI applications, contains a flaw in the `safe extract tarfile()` function. This function inadequately validates symlink targets within tar files. Specifically, it verifies the symlink's own path but does not check the path to which the symlink points. An attacker can exploit this by crafting a malicious tar file containing a symlink that points to a location outside the intended extraction directory, followed by a regular file. When the tar file is extracted, writing through the symlink can result in arbitrary file write on the host filesystem. The vulnerable code resides in `src/bentoml/ internal/utils/filesystem.py` lines 58-96. The issue is present in all versions containing the `safe extract tarfile()` function. A proof of concept demonstrates the ability to overwrite files, potentially leading to remote code execution, especially in scenarios involving shared bentos or BentoCloud deployments.

The software contains an improper URL scheme validation issue in the `assertBrowserNavigationAllowed()` function. Authenticated users with browser-tool access can navigate to file:// URLs, potentially allowing attackers to access local files readable by the OpenClaw process user through browser snapshot and extraction actions, leading to sensitive data exfiltration. The vulnerable component is located in `src/browser/navigation-guard.ts`. The issue arises because the `assertBrowserNavigationAllowed()` function only validated `http:` and `https:` network targets, implicitly allowing other schemes. An attacker with valid gateway credentials and browser-tool access can exfiltrate local files readable by the OpenClaw process user.

NocoDB is software for building databases as spreadsheets. An authenticated user with a Creator role can inject arbitrary SQL code through the `unit` parameter of the DATEADD formula. The third argument (`unit`) of the `DATEADD` function was directly interpolated into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types, allowing non-Literal types to bypass validation. This affects MySQL, PostgreSQL, and SQLite function mappings. Successful exploitation could lead to data exfiltration or modification of the connected database.

Actual is a local-first personal finance tool. In multi-user mode (OpenID), the sync API endpoints (`/sync/*`) do not verify that the authenticated user owns or has access to the file being operated on. Any authenticated user can read, modify, and overwrite any other user's budget files by providing their file ID. The issue affects the following API endpoints: `/sync/download-user-file`, `/sync/upload-user-file`, `/sync/sync`, `/sync/user-get-key`, `/sync/user-create-key`, `/sync/reset-user-file`, `/sync/update-user-filename`, and `/sync/get-user-file-info`. The `validateSessionMiddleware` confirms user authentication, but endpoints lack checks to ensure the user owns or has access to the file. File IDs can be discovered through various methods, including admin access and user sharing. This allows an attacker to steal financial data, modify budgets, and tamper with encryption keys.