Sfwani

The supervisor workload server lacks proper authentication, allowing workloads to manipulate runs from other deployments without ownership verification. An attacker with network access and a valid run/snapshot pair can access the 'attempts/start' endpoint to retrieve resolved environment variables and run JWTs (JSON Web Tokens, which are used for secure transmission of information between parties). Additionally, this allows the attacker to start, complete, or suspend runs belonging to other tenants.

Missing authentication in the realtime streams POST handler allows unauthenticated attackers to inject arbitrary data into run streams across any environment, including production. This occurs because the `action` handler in the file `apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts` lacks an authentication wrapper. Furthermore, the system performs run lookups using the `friendlyId` variable without verifying the `runtimeEnvironmentId`, and these identifiers follow predictable patterns. The affected API endpoint is '/realtime/v1/streams/:runId/:streamId'.

Self-hosted deployments using the default secrets from `hosting/docker/.env.example` are susceptible to a multi-stage unauthenticated attack chain. The issue stems from hardcoded cryptographic secrets, specifically the `MAGIC LINK SECRET`, which allows an attacker to forge valid magic link tokens and authenticate as any email address. This authentication bypass enables attackers to access internal infrastructure networks. From runner containers, attackers can reach Postgres, Redis, and ClickHouse using default credentials, leading to a complete compromise of all tenant data, API keys, and encrypted secrets. The vulnerability is further exacerbated by the reuse of `SESSION SECRET` for JWT signing and the lack of authentication for Redis.

An issue exists in the AI table generation feature where the `uploadUrl()` function in `packages/server/src/utilities/fileUtils.ts` utilizes raw node-fetch instead of a restricted fetch method. Authenticated builder users can exploit this by sending a prompt to the 'POST /api/ai/tables' endpoint that includes an internal URL in an attachment column. This causes the server to fetch the internal resource and return a presigned object-storage URL containing the response, which may expose sensitive data such as cloud metadata credentials. Server-side request forgery (SSRF) is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

An unsafe deserialization issue exists in the WebDataset reader. An attacker can achieve remote code execution by providing a malicious tar archive to the `read webdataset()` function. The ` default decoder()` function in webdataset datasource.py unconditionally calls `pickle.loads()` on tar entries with .pkl or .pickle extensions and `torch.load()` with `weights only=False` on .pt or .pth entries. This results in the execution of arbitrary code within Ray remote workers on every worker that processes the malicious archive. Deserialization is the process of converting a data format back into an object, which becomes unsafe when untrusted data is processed without validation.

An access control bypass exists in the `previewFileFromExecution` endpoint (GET '/api/v1/{tenant}/executions/{executionId}/file/preview'). This issue allows an authenticated user to read output files from any other execution within the same tenant, effectively bypassing namespace-level and execution-level isolation. This is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input.