Tarpeg007

The software fails to invalidate issued tokens for run as users who have zero static roles. This occurs because the `check token()` function does not consult the blacklist. Consequently, attackers whose administrator grants have been revoked can continue to authenticate and self-link the administrator role to maintain privileged access permanently.

An arbitrary file overwrite issue exists in the `MasterHandler.process files from worker()` function. A compromised cluster worker can bypass protections using a trailing-slash basename bypass and the absence of `extra valid` enforcement to overwrite protected master files, specifically `ossec.conf` and `agent.conf`. This allows for root remote code execution across the manager and all associated agents. Exploitation requires a cluster key or privileged API access.

A heap buffer overflow exists in the `fim generate alert()` function. The issue occurs because the `full log` variable is sized based on input but written with a boundary defined by `OS MAXSTR`. An enrolled agent can exploit this by sending a specially crafted FIM syscheck event to corrupt the manager heap memory, leading to a deterministic crash of the `wazuh-analysisd` process and resulting in a fleet-wide detection outage.

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress allows unauthenticated attackers to extract arbitrary postmeta values from all published posts. This is achieved through character-by-character substring matching across the entire wp postmeta table using the `wpr keyword` parameter. The required nonce is publicly available via wp localize script on any frontend page that loads a Royal Elementor widget, removing the need for an authenticated session.

An issue exists in the Form Builder widget's `webhook url` setting that allows Server-Side Request Forgery (SSRF), a flaw where an attacker forces a server to make requests to an unintended location. The `render()` method saves a user-controlled URL into the `wpr webhook url {widget id}` option. Subsequently, the `wpr form builder webhook` AJAX handler reads this option and executes an outbound request using the `wp remote post()` function. Because the process lacks a host allowlist, scheme restrictions, and filters for private or loopback IP addresses, authenticated attackers with Contributor-level access or higher can trigger web requests to arbitrary locations from the server to query or modify internal services.

The software fails to escape the `DataValue.index` field when constructing OpenSearch bulk requests. This allows enrolled agents to inject arbitrary NDJSON (Newline Delimited JSON) operations. Attackers can smuggle delete, index, or update operations into bulk requests executed with the manager's admin credentials, which can lead to document deletion, alert tampering, and cross-agent SIEM state manipulation.

The `setCookie()` utility did not properly validate semicolons (;), carriage returns (r), or newline characters ( ) in the `domain` and `path` options when creating the `Set-Cookie` header. Because cookie attributes are separated by semicolons, this could allow an attacker to inject additional cookie attributes if untrusted input is used in these fields. The issue stems from the interpolation of the `domain` and `path` options without rejecting unsafe characters. Including characters like `;`, `r`, or ` ` could lead to unintended cookie attributes being added to the header, potentially affecting cookie scoping or security. Exploitation requires misuse of cookie options at the application level.

Hono is a Web application framework supporting various JavaScript runtimes. A flaw exists where the `event`, `id`, and `retry` fields within the `streamSSE()` function in the Streaming Helper were not properly validated for carriage return (r) or newline ( ) characters. The Server-Sent Events (SSE) protocol utilizes line breaks to delineate fields. Consequently, if untrusted input containing these characters was supplied to these fields, it could enable the injection of additional SSE fields within the same event frame. The issue stems from the SSE helper constructing event frames by joining lines with , and previously allowing raw values without rejecting CR/LF characters in the `event`, `id`, and `retry` fields. This could lead to the injection of additional fields like `data:`, `id:`, or `retry:`. Applications that render `e.data` unsafely, such as using `innerHTML`, could be vulnerable to client-side script injection.