Raphael Vinot

A path traversal issue exists in the archive extraction worker. This occurs when the system processes a specially crafted archive or disk image and fails to ensure that the destination paths remain within the intended extraction directory. An attacker can submit a malicious file using path traversal sequences to write content outside the designated directory, which may lead to the unauthorized modification of system or application files, denial of service, or further system compromise depending on process permissions.

An issue exists in the favicon retrieval functionality where the application fails to validate redirects when `only global lookup` is enabled. While the initial favicon URL is checked to prevent requests to localhost, loopback, or non-public network addresses, subsequent redirects handled by aiohttp bypass this validation. An attacker can provide a public URL that redirects to a restricted internal address, such as `127.0.0.1` or `localhost`, causing the host to issue unauthorized HTTP requests. This can be used to probe internal HTTP services or extract information from inaccessible endpoints.

A stored cross-site scripting issue exists in the PDF download functionality. The endpoint '/task-download/<task id>/.../pdf' uses content-based detection to verify files as PDFs but fails to explicitly specify the MIME type or force the file to be downloaded as an attachment when using the `send file()` function. An attacker can upload a polyglot file—a file that is valid in two different formats—which Pandora recognizes as a PDF, but whose filename triggers the server to return a different active MIME type. This allows the browser to interpret the file as HTML or another executable web format, executing attacker-controlled scripts within the application's security context and potentially compromising the victim's session data.

Stored cross-site scripting (XSS) occurs during the rendering of URL observables. A URL associated with an analyzed file is inserted directly into the inline JavaScript onclick handler of the Submit to Lookyloo action. Because the value is embedded within a JavaScript string inside an HTML attribute, an attacker can use specially crafted characters to break the string and inject arbitrary JavaScript code. This script executes in the context of the web application when a user interacts with the Submit to Lookyloo control, potentially allowing the attacker to access browser information or perform actions using the victim's authenticated session.

Pandora contains a denial-of-service issue in its handling of DAA (Direct Access Archive) files. During the extraction of an internal ISO image from a DAA archive, the system uses the `zlib.decompress()` function to process compressed chunks without enforcing a limit on the resulting uncompressed data. An attacker can submit a crafted DAA file containing highly compressed data, causing the system to expand a small input into an excessively large amount of data in memory. This process can lead to extreme memory consumption and CPU exhaustion, which may cause the extraction worker to become unresponsive or terminate, impacting the overall availability of the service. This type of attack is known as a decompression bomb, where a small file is designed to consume vast amounts of system resources upon decompression.

Pandora contains a path traversal issue in its TAR archive extraction functionality. The extractor passes archive member names directly to the `tarfile.TarFile.extract()` function without applying an extraction filter. An attacker can submit a specially crafted TAR archive containing malicious member paths, such as absolute paths or sequences using `../`, to write files outside the intended extraction directory. This can lead to the overwriting of files accessible to the Pandora worker process, potentially resulting in arbitrary code execution, application compromise, or denial of service.

A Server-Side Request Forgery (SSRF) issue occurs when the `only global lookup` option is enabled. While this option is intended to block access to local, loopback, or non-public network resources, the favicon retrieval process bypasses these protections. Favicon URLs extracted from HTML are fetched directly using an `aiohttp.ClientSession` without proper validation. An attacker controlling a processed web page can use a crafted favicon reference to force the host to make HTTP requests to internal network services, private IP addresses, or loopback addresses. This can lead to internal service discovery or unauthorized interaction with internal HTTP endpoints.

Lookyloo fails to enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker can submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to an excessive size during processing. Since the application decompresses this content directly in memory without limiting the output size, it can lead to memory exhaustion, termination of web or worker processes, or complete instance unavailability. This issue affects full capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation may result in a persistent denial-of-service condition, which is a state where a service is unavailable to its intended users, until the affected processes or instance are restarted.

A stored cross-site scripting issue exists on the capture tree visualization page. The application embeds serialized capture tree data directly into an inline JavaScript block using the Jinja safe filter. Since this data can include attacker-controlled web content, a crafted value can terminate the `<script>` element and inject arbitrary HTML or JavaScript. This allows the execution of malicious code in the browser of a user viewing the capture tree, potentially enabling the attacker to perform actions via the victim's authenticated session, access sensitive information, or modify application data.

PlaywrightCapture stored configuration and runtime data as mutable class-level variables instead of instance-level variables. This allows multiple Capture objects within the same Python process to share state, including HTTP headers, cookies, browser storage, HTTP credentials, proxy configuration, user-agent settings, geolocation information, and captured request data. In concurrent or multi-user deployments, data from one capture can persist and be reused by others, potentially leading to the disclosure of authentication cookies, credentials, or browser storage. This may also allow requests to be executed using another capture's authentication context or proxy configuration, enabling unauthorized access to remote resources.