Snailsploit

A Kafka broker using the bundled JWKS-backed validator for SASL/OAUTHBEARER authentication verifies JWT signatures but does not enforce issuer and audience checks by default. Specifically, the issuer (`iss`) claim is only verified if `sasl.oauthbearer.expected.issuer` is configured, and the audience (`aud`) claim is only required if `sasl.oauthbearer.expected.audience` is configured. In multi-tenant environments or deployments with shared JWKS endpoints, this may allow a token from a different issuer or one lacking an audience to be accepted, potentially granting access as a higher-privileged principal.

In the `AgentServer` component, the `ServerConfig.auth token` variable is exposed but not validated by the `AgentServer. create app()` function across any routes. This allows a remote caller to perform actions without a valid bearer token or `X-Auth-Token`, even when authentication is configured. An unauthenticated attacker can eavesdrop on the event bus, inject control events into agent processes, and leak server configurations.

The `ast grep rewrite()` function in the `praisonaiagents/tools/ast grep tool.py` component lacks the `@require approval` decorator used by other mutation tools. When the `dry run` variable is set to `False`, an agent can execute the function to rewrite matching files across a specified `path` without requiring authorization. This allows for the modification of any file the host process has permission to write, including source trees and build configurations. Furthermore, the function incorrectly returns the string "No changes made" even when files are successfully modified, hiding the action from the operator. This issue can be triggered if an agent is steered via prompt injection to call the function with attacker-controlled `pattern`, `replacement`, and `path` variables.

The RC API includes full Go stack traces in error responses when panics occur. This allows attackers to trigger panics to leak sensitive information, including internal file paths, module versions, goroutine states, and memory addresses.

PraisonAI caches tool approval decisions using only the tool name, which allows the reuse of an initial approval for subsequent calls with arbitrary arguments. An attacker can obtain approval for a benign operation and then execute dangerous operations, such as file writes, with unreviewed parameters within the same session. This occurs because the `ApprovalRegistry.is already approved()` function returns `True` if the tool name exists in the per-run context set, regardless of the arguments used. The `approve sync()` and `approve async()` functions short-circuit based on this cache before consulting the approval backend. While critical-tier tools like `execute command()` and `execute code()` are exempt, high-risk tools such as `write file()` are affected.

A prompt injection defense bypass exists because the system only blocks threats classified as CRITICAL, which requires three or more detector families to match simultaneously. This allows attackers to use single or double-vector prompt injections that are classified as HIGH threat level to bypass the defense and reach the model.

Server-Side Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) exist in the `markdown to pdf` action. These issues occur because the PDF rendering engine fails to restrict script execution and outbound network access, allowing remote attackers to execute JavaScript on the server and initiate arbitrary outbound HTTP requests through specially crafted content embedded in Markdown input.

Missing permission checks allow users with Overall/Read permission to enumerate the names of configured Contrast metadata.

The XML parser is not configured to prevent XML external entity (XXE) attacks. This allows attackers who can control the responses from the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location.

A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL using a specified username and password.

An incomplete fix for a previous memory leak issue allows unauthenticated attackers to leak heap memory addresses. The system fails to properly sanitize error messages in several response paths, echoing the string representation of exceptions directly to clients. This occurs because certain routes catch exceptions internally and construct responses themselves, bypassing the global sanitizing exception handler, while WebSocket frames bypass the handler chain entirely. Technical details include: - **API Endpoints**: 'POST /v1/messages' and 'POST /v1/messages/count tokens' within the Anthropic API router. - **Vulnerable Components**: The Server-Sent Events streaming converter in `vllm/entrypoints/anthropic/serving.py` and the realtime speech-to-text WebSocket in `vllm/entrypoints/speech to text/realtime/connection.py`. An attacker can exploit this by sending malformed image bytes through the Anthropic Messages API image content parts. This causes the `PIL.Image.open()` function to raise an `UnidentifiedImageError`, which includes a `BytesIO` object representation containing a verbatim heap memory address in the `error.message` field of the response body.

The software is subject to Server-Side Request Forgery (SSRF), a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Missing authorization flaws in the `editUser()` and `updateUserRights()` endpoints allow authenticated administrators to escalate privileges. An authenticated non-SuperAdmin user possessing the `edit user` permission can modify the `is superadmin` flag or grant arbitrary rights to an account, enabling them to gain full SuperAdmin access and complete control over the knowledge base.

The MCP SSE server allows unauthenticated cross-origin MCP tool invocation because the server defaults to an empty secret and the `isAuthorized()` function returns true when the secret is empty. While a previous update restricted CORS to localhost origins, the server remains unauthenticated by default for non-browser callers, such as curl or SSRF. This allows unauthorized access to 22 MCP tools, including `config set`, `agent spawn`, `blackboard write`, and `token *` functions, especially when a non-loopback bind is used.

An issue exists in the open source video platform where the endpoint "objects/mention.json.php" lacks a `User::loginCheck()` or admin gate. The endpoint only implements an entry guard using `preg match('/^@/', $ REQUEST['term'])` and a hard-coded `rowCount=10`. This allows unauthenticated users to perform user enumeration by manipulating the `term` variable.

Certain components, including `EpgParser.php` and `plugin/AI/receiveAsync.json.php`, fail to utilize the `$resolvedIP` out-parameter of the `isSSRFSafeURL()` function for DNS pinning via `CURLOPT RESOLVE`. This oversight creates a Time-of-Check to Time-of-Use (TOCTOU) condition, which allows for DNS rebinding attacks. DNS rebinding is a technique used to bypass security restrictions by changing the IP address associated with a domain name between the time the application validates the address and the time it actually accesses the resource.

Two endpoints, 'plugin/AI/receiveAsync.json.php' and 'objects/EpgParser.php', use the `isSSRFSafeURL()` function to validate user-supplied URLs but then fetch them using `file get contents()` without disabling automatic redirect following. This allows an attacker to provide a URL that redirects to an internal or cloud-metadata address (such as 'http://169.254.169.254/latest/meta-data/'), bypassing SSRF protections because only the initial URL is validated. This can lead to the exfiltration of IAM credentials, instance identity, or access to internal services and port scanning. Additionally, several callers of `isSSRFSafeURL()` discard the `$resolvedIP` parameter intended for DNS pinning, making them susceptible to DNS rebinding TOCTOU (Time-of-Check to Time-of-Use) attacks. This occurs when a domain's DNS record changes between the time of validation and the time of the actual request. Affected callers include: - 'objects/aVideoEncoderReceiveImage.json.php' - 'objects/aVideoEncoder.json.php' - 'plugin/BulkEmbed/save.json.php' - 'plugin/AI/receiveAsync.json.php' - 'objects/EpgParser.php' - 'plugin/Scheduler/Scheduler.php'

DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation within the `Untar()` and `Unzip()` functions located in `pkg/archive/archive.go`.

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. A denial of service can occur due to recursive `<use>` element amplification within the `cairosvg/defs.py` file, specifically in the `use()` function. This amplification leads to CPU exhaustion even from a small input file. A 1,411-byte SVG payload can pin the CPU at 100% indefinitely. The issue arises from the recursive processing of `<use>` elements without depth or count limits. The amplification factor is O(10^N) rendering calls from O(N) input.