Skelmis

The OpenObserve open-source observability platform has a security issue where it does not sanitize user input in the filter selection menu, potentially leading to complete account takeover. The front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) in many areas, but certain parts lack this protection. Combining the missing protection with insecure authentication handling, a malicious user may be able to take over any victim's account if they meet the exploitation steps.

A Stored Cross Site Scripting issue allows a remote attacker to escalate privileges via the notifications.html component.

An MFA bypass exists in the OAuth flow of Firefly III, which allows malicious users to circumvent the multi-factor authentication check. This flaw enables attackers to use password spraying—a technique where common passwords are tried against many accounts—to gain access to data using credentials stolen from other sources. Because OAuth applications use an incrementing ID, they are easily enumerable, allowing an attacker to potentially register an OAuth application to a user's profile. Successful exploitation requires the attacker to possess the victim's username and password.

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks.

The issue concerns the Piccolo Admin interface, which allows media file uploads, including SVG files by default. An attacker can upload a malicious SVG file, which, when loaded, can provide arbitrary access to the admin page. This access enables the attacker to perform various actions, such as gaining access to all data stored within the admin page, creating, modifying, or deleting table records. The vulnerability exploits the context of an authenticated admin session, allowing the attacker to make actions that would normally be restricted.

The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. This could allow a malicious user to have direct access to the database and modify data to the level of permissions associated with the database user. Possible actions based on database permissions include reading all data stored in the database, inserting arbitrary data, and gaining a shell on the underlying server.

ZITADEL is an identity infrastructure management system where users can upload their own avatar image using various image types, including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to an SVG to gain access to the victim’s account in certain scenarios. A victim would need to directly open the malicious image in the browser, where a single session in ZITADEL needs to be active for this exploit to work. If the possible victim had multiple or no active sessions in ZITADEL, the attack would not succeed.

The implementation of `BaseUser.login` in Piccolo leaks enough information to a malicious user, allowing them to generate a list of valid users on the platform. This list can be used in a password spray attack to attempt to take over user accounts on the platform. The impact of this issue is minor, as it requires chaining with other attack vectors to gain more than just a list of valid users. The likelihood of this issue is possible, as it requires minimal skills to exploit, especially given that the underlying login functionality for Piccolo-based sites is open source.