Thomasrinsma

**Name of the Vulnerable Software and Affected Versions** Feathersjs versions 5.0.39 and below **Description** Feathersjs is a framework used for building web APIs and real-time applications. A flaw exists where the redirect query parameter is added to the base origin without proper validation. This allows attackers to steal access tokens through URL authority injection, potentially leading to full account takeover. The application builds the redirect URL by combining the base origin with a user-provided redirect parameter. This is exploitable when origins do not end with a forward slash (/). An attacker can provide a malicious redirect value, such as `@attacker.com`, resulting in a URL like `https://target.com@attacker.com#access token=...`. The browser then interprets `attacker.com` as the host, enabling the attacker to obtain the victim's access token and impersonate them. **Recommendations** Update to version 5.0.40 or later.

**Name of the Vulnerable Software and Affected Versions** Feathersjs versions 5.0.39 and below **Description** Feathersjs is a framework used for building web APIs and real-time applications. A flaw in origin validation, specifically using the `startsWith()` function for comparison, allows attackers to bypass origin checks. This bypass is possible by registering a domain that shares a common prefix with an allowed origin. The `getAllowedOrigin()` function inadequately validates the prefix of the Referer header against allowed origins. An attacker can initiate the OAuth flow from an unauthorized origin and potentially steal tokens, leading to full account takeover. **Recommendations** Update to version 5.0.40 or later.

**Name of the Vulnerable Software and Affected Versions** Feathersjs versions 5.0.39 and below **Description** Feathersjs is a framework used for building web APIs and real-time applications. Versions 5.0.39 and below store all HTTP request headers in a session cookie that is signed but not encrypted. This can expose internal proxy/gateway headers to clients. The OAuth service stores the complete headers object in the session, which is then persisted using cookie-session and base64-encoded. While the cookie is signed, the data is readable by decoding the base64 value. In certain deployment configurations, such as those behind reverse proxies or API gateways, this can lead to the disclosure of sensitive internal infrastructure details like API keys, service tokens, and internal IP addresses. The issue involves the storage of sensitive information in the session cookie, specifically impacting the handling of HTTP request headers and OAuth service data. **Recommendations** Update to version 5.0.40 or later.

**Name of the Vulnerable Software and Affected Versions** Stalwart versions 0.13.3 and below **Description** Stalwart, a mail and collaboration server, has an issue where the IMAP protocol parser can allocate an unlimited amount of memory. This can allow a remote attacker to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The `CommandParser` implementation generally limits the size of its dynamic buffer during parsing, but some state handlers do not perform these validation checks. **Recommendations** Update to version 0.13.4 or later. Implement rate limiting and connection monitoring at the network level as a workaround.

**Name of the Vulnerable Software and Affected Versions** react-pdf versions prior to 7.7.3 react-pdf versions prior to 8.0.2 **Description** The issue arises when PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true`, which is the default value. This configuration allows unrestricted attacker-controlled JavaScript to be executed in the context of the hosting domain. **Recommendations** For versions prior to 7.7.3, update to version 7.7.3 or later. For versions prior to 8.0.2, update to version 8.0.2 or later. As a temporary workaround, consider setting the option `isEvalSupported` to `false` to minimize the risk of exploitation. Set `options.isEvalSupported` to `false`, where `options` is `Document` component prop.

**Name of the Vulnerable Software and Affected Versions** Sails versions prior to 1.5.7 **Description** Sails is a realtime MVC Framework for Node.js. An attacker can send a virtual request that will cause the node process to crash. **Recommendations** For versions prior to 1.5.7, update to version 1.5.7 to resolve the issue. As a temporary workaround, consider disabling the sockets hook and removing the `sails.io.js` client until the update is applied.