Sam Sanoop

Name of the Vulnerable Software and Affected Versions: hackney versions 0.0.0 and later Description: The issue arises from improper parsing of URLs by the URI built-in module and hackney, leading to Server-side Request Forgery (SSRF). Given a URL like http://127.0.0.1?@127.2.2.2/, the URI function correctly identifies the host as 127.0.0.1, but hackney incorrectly refers to the host as 127.2.2.2/. This can be exploited when users rely on the URL function for host checking. Recommendations: For hackney versions 0.0.0 and later, consider disabling the URL parsing functionality until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `URI` module for host checking in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A code execution issue exists due to improper neutralization of special elements used in an OS command. This issue can be exploited by adding an untrusted Helm catalog or modifying the URL configuration used to download KDM, allowing for command injection in the underlying Rancher host. By default, only the Rancher admin has permission to manage these configurations. The issue can potentially be exploited in two ways: adding an untrusted Helm catalog that contains maliciously designed repo URL configuration in Helm charts, or modifying the URL configuration used to download KDM releases.

The issue arises from the failure to sanitize `gcov` arguments before they are provided to the `popen` method. This lack of sanitization can lead to potential exploitation.

The issue allows a malicious module to overwrite files on an arbitrary file system through the module install functionality.

The issue relates to the concentration of arrays by ini parser.js. If user input is provided, an attacker can potentially overwrite and pollute the object prototype of a program.

The issue affects browserless-chrome, where user input from the "workspace endpoint" is used to create a file path `filePath`. This `filePath` is then fetched and sent back to the user, allowing for the potential to escape and fetch arbitrary files from a server.

This issue relates to the `deepExtend` function, part of the utils directory. Depending on user input, an attacker can overwrite and pollute the object prototype of a program.

The issue allows request smuggling attacks when agoo is used as a backend and a frontend proxy is also vulnerable. This is due to incorrect parsing of `Content-Length` and `Transfer Encoding` headers, which can lead to HTTP pipelining issues and request smuggling attacks. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers. Additionally, sending the `Content-Length` header twice or using invalid `Transfer Encoding` headers can be leveraged for TE:CL smuggling attacks.

The issue allows for Request Smuggling attacks due to incorrect parsing of Content-Length and Transfer encoding headers. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Additionally, invalid Transfer Encoding headers are parsed as valid, which could be leveraged for TE:CL smuggling attacks. The project is deprecated and no longer maintained.

The issue allows modification of object properties. Specifically, the `merge` method could be tricked into adding or modifying properties of the `Object.prototype`.

The issue arises from the mishandling of the xlink namespace by the sanitizer, allowing bypass of svg-sanitize using the `xlink:href` attribute.

The issue allows for potential timing attacks, which under certain conditions, could lead to the practical recovery of the long-term private key generated by the library. This is due to the possible leakage of a bit-length of the scalar during scalar multiplication on an elliptic curve.