Therawdev

Three Livewire admin components contain authorization gaps that allow a staff member with only `view users` and `access dashboard` permissions to perform privileged actions. This improper authorization enables an attacker to escalate their own privileges by granting arbitrary permissions to their role, create a new administrator account with a chosen password, or delete roles and permission definitions, leading to a Role-Based Access Control (RBAC) denial of service. The technical details of the affected components are as follows: - In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, the functions `togglePermission()` and `removePermission()` incorrectly authorize the `view users` permission instead of the required `access setting` permission. Additionally, the file `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. - In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, the `mount()` and `store()` functions accept the `view users` permission, allowing the creation of a pre-verified administrator via the `role id` variable. - In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, the `deleteAction` function lacks action authorization and only checks if the role can be removed, while page access is granted via `view users`.

A flaw exists in the markdown artifact preview pipeline. The `generateMarkdownHtml()` function (located in `client/src/utils/markdown.ts`) utilizes a custom image renderer that triggers a fallback to the default renderer of the marked library (v15.0.12) when URLs pass the `isSafeUrl` allowlist check. This default renderer fails to HTML-escape double-quote characters within image alt text. An attacker can exploit this by crafting alt text containing double quotes and event handlers, such as `" onload="payload`, to break out of the attribute and execute arbitrary scripts in the victim's browser via the `innerHTML` property of the content element within the Sandpack preview iframe.

An authenticated Subsonic user can bypass ownership checks to read or delete playlists belonging to other users and probe arbitrary file paths on the host for existence or readability. This occurs because the `playlist.UserID` is derived from the first path segment of the playlist ID, but there is no path containment on the resolved file path. The issue involves path traversal within the `id` parameter, allowing a bypass of the boundary intended to prevent insecure direct object references (IDOR), which is a vulnerability where an application provides direct access to objects based on user-supplied input.

The Subsonic API endpoints '/rest/deletePlaylist.view' and '/rest/getPlaylist.view' lack per-resource authorization. An authenticated user, regardless of privilege level, can delete any playlist or read the full contents (name, comment, and song list) of any private playlist belonging to another user, including administrators, by providing the playlist `id`. The playlist `id` is generated using `base64url("<userID>/<filename>.m3u")`. Since `userID` is a small integer and filenames are either user-supplied or time-derived, these IDs are guessable or may have been previously exposed, allowing low-privileged users to delete administrator playlists or exfiltrate private data.

A logic error in the `ServeCreateOrUpdatePlaylist()` function allows for arbitrary file write operations within the music streaming server.

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.212 Description FreeScout, a help desk and shared inbox built with PHP's Laravel framework, does not properly consider the `limit user customer visibility` parameter when merging customers in versions prior to 1.8.212. Recommendations Update to version 1.8.212 or later.