Vulncheck

A heap out-of-bounds write occurs in the `parse multipart()` function. Unauthenticated attackers can corrupt memory by providing an empty multipart boundary. By sending a single crafted multipart/related request to the SBI (Service Based Interface) of any network function, the lookbehind buffer is overflowed, leading to a system crash.

An out-of-bounds read exists in the `parse scheme output()` function within lib/sbi/conv.c during SUCI (Subscription Concealed Identifier) de-concealment. This issue stems from incomplete length validation, allowing remote unauthenticated UEs (User Equipment) or SBI (Service Based Interface) peers to submit a crafted SUCI with a 42-byte scheme output to a UDM (Unified Data Management), which triggers a heap over-read past the buffer.

An issue exists where a truncated HTTP/2 Content-Length value can be used to exhaust the worker pool of an HTTP/1.1 origin.

A path traversal issue exists where a malicious application can write files into the private data directory of the software. This is achieved by exploiting the exported `crosslaunch.share` activity and an unsanitized display name retrieved from a ContentProvider used during file path construction. An attacker can use a shared `content://` URI containing `../` sequences in the display name to place controlled content into directories including `databases/`, `shared prefs/`, `no backup/`, and `files/` without requiring user interaction.

A heap buffer over-read exists in the `xmlparse.c` file. The `XML ParseBuffer()` function advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer size. Repeated calls to `XML ParseBuffer()` can move the `m bufferEnd` variable past the end of the heap allocation, causing subsequent parsing to read out of bounds. This path is reachable if a parse buffer is already present, which occurs after a call to `XML GetBuffer()` or an internal allocation via `XML Parse()`. This issue allows the disclosure of adjacent heap memory, which can leak heap pointers, libc function pointers, and code pointers, potentially defeating Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to make exploitation harder.

An issue exists in the `ThemeModule::startImport()` function where uploaded ZIP archives are extracted directly into the public web root without validation of file names, extensions, or content. An authenticated administrator can exploit this by uploading a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, allowing the execution of arbitrary OS commands as the web-server user via the themes directory.

A server-side template injection occurs because the raw Django HttpRequest object is exposed to the Jinja2 template context. A low-privileged user with the "Can add custom links" permission can exploit this by crafting a custom link template that embeds `request.COOKIES['sessionid']` or an API token into an img src URL. This technique bypasses the `clean html` sanitizer, allowing the automatic exfiltration of a privileged user's session cookies and API tokens to an external host when the object is viewed, which can lead to full account takeover.

A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the `secu ` anti-forgery parameter is omitted in the 'crayons store.php' endpoint, causing the authorization dispatcher to resolve an unconditionally-true handler instead of performing the proper modification check. This flaw can be chained to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, resulting in arbitrary PHP code execution as the web-server user.

An incorrect authorization issue exists in the Admin web application's first-run setup endpoint. The `SetupResource` incorrectly determines if the setup process is available by counting only direct members of the `camunda-admin` group instead of recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to access the setup user-create endpoint and create a new administrator account if the `camunda-admin` group is empty, even if the system is already fully administered. This can lead to account takeover, unauthorized process deployment, or script execution as the engine's service user.

An authenticated attacker can exploit a PHP object injection issue within the `processFormData()` function of `WidgetSelect`. This occurs because the application performs `unserialize()` on raw POST data for multiple-select fields without applying an `allowed classes` filter. By submitting a serialized `XLSXWriter` object as a field value, an attacker can trigger the ` destruct()` method to delete arbitrary files, such as `config.php` or backup data. This can lead to a denial of service or a potential application reinstall hijack.

An authentication bypass exists that allows remote attackers to obtain full administrative API access. This occurs because the `InternalApiKeyFilter` accepts a valid `Utm-Internal-Key` header matching the `INTERNAL KEY` environment variable for any endpoint. The implementation lacks path restrictions, constant-time comparison, rate limiting, and audit logging. Attackers possessing this key can bypass user account requirements or JSON Web Tokens (JWT) to create accounts, manage users, exfiltrate data, and modify security rules.

Authenticated attackers can perform a server-side request forgery (SSRF), a flaw where the server is tricked into making requests to an unintended location. By providing an unvalidated `url` parameter to the `downloadPdf()` function within the `PdfService`, exposed via the GET '/api/generate-pdf-report' endpoint, attackers can force the web-pdf microservice to access internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service. This allows sensitive internal data to be retrieved and rendered into the resulting PDF file.

Authenticated attackers can read arbitrary entity data by exploiting a JPQL injection issue. The vulnerability exists in the `UtmNetworkScanService.searchPropertyValues()` function, which constructs a JPQL query using `String.format()` and executes it via `em.createQuery()` without proper parameter binding. By sending malicious JPQL through the `value` parameter in the 'GET /api/utm-network-scans/searchPropertyValues' endpoint, attackers can extract sensitive information, including credential tables such as `jhi user`. JPQL (Java Persistence Query Language) is an object-oriented query language used to perform database operations on entities.

An authorization flaw exists in the `UTMIncidentCommandWebsocket.processCommand()` function, which handles the '/command/{hostname}' STOMP destination. The system fails to perform role checks or apply a command allowlist before forwarding instructions. Consequently, any authenticated user can send arbitrary operating-system commands via gRPC to any connected agent, leading to command execution on monitored endpoints where agent processes typically operate with root or SYSTEM privileges.

An issue exists in the `searchQueryBuilder()` function of `UtmAssetGroupService` where authenticated attackers can inject arbitrary SQL. This occurs because the `assetType` and `groupName` variables are inserted unsanitized into a native PostgreSQL query using `String.format()`. Exploitation of the GET '/api/utm-asset-groups/searchGroupsByFilter' endpoint allows the execution of arbitrary SQL with DBA privileges, which can lead to full database read, data modification, and potential filesystem access.

An account enumeration issue exists that allows unauthenticated attackers to identify registered email addresses. By sending requests to the 'POST /api/account/reset-password/init' endpoint, attackers can distinguish between registered and unregistered accounts based on the HTTP response. Registered accounts return a 200 OK response, while unregistered accounts trigger a 500 Internal Server Error containing backend details. This information can be used to facilitate targeted phishing or credential attacks.

An issue exists in the REST API where object-level authorization is missing. Authenticated users with a valid API key can bypass the `security.restrict access` confidentiality control because the `allowAccess()` authorization routine is not invoked. This allows attackers to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to via the following endpoints: 'single get', 'single comments', and 'single comments post'.

An authenticated attacker can trigger a server-side request forgery (SSRF) by providing a malicious metadata URL to the `POST/PUT /api/identity-providers` endpoint. This occurs because the `IdentityProviderService.validateMetadataUrl()` function fails to validate the target host, IP, or scheme. This flaw allows the server to send requests to arbitrary internal or cloud metadata hosts, enabling internal network port scanning and unauthorized access to cloud instance-metadata services.

A division-by-zero issue exists in the LC3plus sink decoder within the `a2dp lc3plus dec thread()` function located in `a2dp-lc3plus.c`. A Bluetooth-adjacent attacker can cause a denial of service by establishing an A2DP source connection and sending a crafted RTP media header where the frame count field is set to zero. This triggers a SIGFPE (floating-point exception), which crashes the daemon on builds compiled with LC3plus support enabled.

An information disclosure issue exists where unauthenticated attackers can obtain the secret `delete code` and uploader metadata. This occurs when calling the 'API::info()' endpoint, which returns the complete raw metadata object without a field whitelist. By using a publicly visible file hash, an attacker can retrieve the `delete code` and subsequently use the delete API to permanently remove arbitrary files. Additionally, this exposes the uploader IP, User Agent, remote port, and SHA-1 hash, compromising content integrity, availability, and uploader privacy.