Snoopysecurity

Certain endpoints fail to enforce proper permission checks, allowing authenticated attackers to bypass role-based access restrictions. This allows the creation of records and modification of data beyond the permissions assigned to the attacker's role.

Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to query these endpoints to read financial data that exceeds the permissions granted by their assigned role.

Missing input validation in certain endpoints allows authenticated low-privileged attackers to execute SQL injection. By sending specially crafted requests, an attacker can inject SQL commands to extract sensitive information from the database.

Certain endpoints fail to enforce proper authorization checks on valuation data. This allows authenticated low-privileged users to query these endpoints and read valuation information that exceeds the permissions assigned to their role.

A Deno program opening a client WebSocket connection can be crashed by a remote server. During the WebSocket handshake response, Deno parsed the 'Sec-WebSocket-Protocol' and 'Sec-WebSocket-Extensions' response headers assuming the bytes were printable ASCII. If a response header contains non-visible-ASCII bytes (`0x80`-`0xFF`), it triggers a panic in the `HeaderValue::to str()` function, which aborts the entire Deno process. This results in a remote denial of service where an attacker controlling the WebSocket endpoint or performing a man-in-the-middle attack on a plaintext 'ws://' connection can terminate the process that initiated the outbound connection.

CarrierWave is a framework used to upload files from Ruby applications. The `content type denylist` check fails to escape regex metacharacters in string entries, causing the denylist to silently fail when matching the content types it is intended to block. In the `denylisted content type()` function, denylist entries are interpolated directly into a regular expression without using `Regexp.quote` or anchoring. For example, an entry like `image/svg+xml` is treated as a pattern where the `+` character is interpreted as a quantifier rather than a literal character, preventing it from matching the actual MIME type. Other content types containing regex metacharacters, such as `application/xhtml+xml`, are similarly affected. This allows an attacker to upload files, such as SVG files containing arbitrary JavaScript, which can lead to stored Cross-Site Scripting (XSS) if the application serves the file inline from its own origin.

A logic flaw in the `find line()` function of the `lxc-user-nic` setuid helper allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When scanning the NIC database to authorize a deletion request, the interface name comparison may set the authorization flag based solely on a name match, ignoring ownership, type, and link fields. This occurs because the check is reachable after the `goto next` label handling, and subsequent processes do not re-verify that the matched entry belongs to the caller. In multi-tenant environments using OpenVSwitch bridges, an attacker with a valid `lxc-usernet` policy entry can trigger the deletion of another user's OVS port on the same bridge, resulting in a denial of service by repeatedly disconnecting networking from other tenants' containers.

Name of the Vulnerable Software and Affected Versions: hackney versions 0.0.0 and later Description: The issue arises from improper parsing of URLs by the URI built-in module and hackney, leading to Server-side Request Forgery (SSRF). Given a URL like http://127.0.0.1?@127.2.2.2/, the URI function correctly identifies the host as 127.0.0.1, but hackney incorrectly refers to the host as 127.2.2.2/. This can be exploited when users rely on the URL function for host checking. Recommendations: For hackney versions 0.0.0 and later, consider disabling the URL parsing functionality until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `URI` module for host checking in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory. This can lead to unintended file modifications. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.