Thesanjok

Missing input validation in certain endpoints allows authenticated attackers to perform SQL injection, which is a technique used to manipulate database queries. By sending specially crafted requests, an attacker can extract sensitive information from the database.

An issue exists in the file serving endpoints '/files/*' and '/file/:fileFolder/:id' where uploaded files are served using `fileStream.pipe(res)` without specifying Content-Type, Content-Disposition, or X-Content-Type-Options response headers. This allows an authenticated attacker to upload an HTML file containing JavaScript that the victim's browser will render within the context of the domain, potentially leading to session hijacking, account takeover, and data theft.

Improper permission handling allows a CMS user with limited page access to copy a page they are not authorized to access to a site area where they do have permissions. This enables the user to view the contents of the unauthorized page and potentially publish it, as permissions were verified for the copy destination but not for the source page.

The Documents and Images API incorrectly lists items in private collections, allowing a user with API access to view the filename and name of documents and images stored within those private collections.

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.40.0 Description cpp-httplib is vulnerable to HTTP Request Smuggling. The server's static file handler serves GET responses without consuming the request body. On HTTP/1.1 keep-alive connections, the unread body bytes remain on the TCP stream and are interpreted as the start of a new HTTP request. An attacker can embed an arbitrary HTTP request inside the body of a GET request, which the server processes as a separate request. Recommendations Update cpp-httplib to version 0.40.0 or later.

The cpp-httplib HTTP client improperly handles cross-origin HTTP redirects (301, 302, 307, 308). Specifically, it forwards stored Basic Auth, Bearer Token, and Digest Auth credentials to arbitrary hosts when following these redirects. A malicious or compromised server can redirect the client to an attacker-controlled host, which then receives the plaintext credentials in the `Authorization` header. This could allow an attacker to obtain sensitive authentication information.

Copyparty is a portable file server. If an attacker has both read and write permissions, they can upload a malicious file named `.prologue.html`. They can then create a link that could execute arbitrary JavaScript in a victim's context. While JavaScript execution is expected when clicking a direct link to the HTML file (e.g., 'https://example.com/foo/.prologue.html'), the issue arises because a link like 'https://example.com/foo/?b' also evaluates the file, leading to unexpected behavior. Existing preventative measures, such as strict SameSite cookies, make exploitation more difficult, requiring the target to click the link from a page served by the server itself, potentially through editing an existing resource. Successful exploitation requires the target to click a specifically crafted link provided by the attacker. The issue is not triggered by normal web UI browsing. If successful, the malicious JavaScript could move or delete existing files on the server, or upload new files, using the account of the person who opens the link.

Copyparty is a portable file server. Prior to version 1.20.12, a missing permission-check existed in the shares feature, specifically with the `shr` global-option. This issue only applies when the shares feature is used to create a share of a single file within a folder, or when the FTP or SFTP server is enabled and publicly accessible. Under these conditions, a user browsing a share via FTP or SFTP (not HTTP or HTTPS) could gain read access to other files in the shared folder by guessing or bruteforcing filenames. Access was limited to sibling files; descending into subdirectories was not possible. The issue is similar to a previously addressed problem for HTTP and HTTPS, but was not initially fixed for FTP. The FTPS server did not exist at the time of the initial fix. The vulnerable parameter is `shr`.