Anuraagbaishya

#5266de 53,779
50.5CVSS total
Vulnerabilidades · 6
Média
1
Alta
3
Crítica
2
PT-2026-22994
8.6
2026-03-02
Php · Php · CVE-2026-28507
**Name of the Vulnerable Software and Affected Versions** Idno versions prior to 1.6.4 **Description** Idno, a social publishing platform, contains a remote code execution vulnerability that can be triggered through a chained sequence of issues. Specifically, a web application administrator can be exploited to write a PHP file to the server's temporary directory via a WordPress import process. Subsequently, any authenticated user can trigger the inclusion of this file through an unsanitized template name parameter, leading to arbitrary operating system command execution as the web server user. The vulnerability involves two main components: arbitrary PHP file write via WordPress import and local file inclusion via an unsanitized template name. The first component, located in `Idno/Core/Migration.php` within the `importImagesFromBodyHTML()` function, allows a web application administrator to cause the server to fetch a URL controlled by an attacker during WordPress import processing. This results in writing a PHP file to the server's temp directory. The second component, present in `Idno/Pages/Search/User.php` and `Idno/Core/Bonita/Templates.php`, allows any authenticated user to trigger the inclusion of the previously written file by providing an unsanitized template name parameter. The `draw()` function in `Idno/Core/Bonita/Templates.php` applies a weak regex that does not prevent path traversal, allowing an attacker to include files outside the intended directory. The vulnerability requires the text plugin to be enabled and `allow url fopen` to be enabled in PHP. **Recommendations** Versions prior to 1.6.4: Upgrade to version 1.6.4 or later to address the vulnerability. Restrict allowed template name characters in `draw()` to an allowlist such as `^[a-z0-9/ -]+$`, rejecting any name containing `../` or beginning with `/`. Validate the extension of files written by `importImagesFromBodyHTML` against an allowlist of image extensions (jpg, jpeg, png, gif, webp) before writing to disk. Validate the hostname of image URLs in `importImagesFromBodyHTML` against the source domain rather than using `substr count`, which does not distinguish hostname from path. Use `tempnam()` for temp files in the import flow rather than constructing filenames from user-controlled URL components.
PT-2026-22995
9.2
2026-03-02
Idno · Idno · CVE-2026-28508
**Name of the Vulnerable Software and Affected Versions** Idno versions prior to 1.6.4 **Description** A flaw exists in the API authentication flow of Idno that allows bypassing of CSRF protection on the URL unfurl service endpoint. This is due to the absence of a login requirement on the endpoint and a logic error in the authentication process. An unauthenticated remote attacker can exploit this to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. The vulnerability is related to the `Idno/Pages/Service/Web/UrlUnfurl.php`, `Idno/Core/Session.php`, and `Idno/Core/Actions.php` components. The affected endpoint is the GET request to '/service/web/unfurl?url=<attacker-controlled-url>', handled by the `IdnoPagesServiceWebUrlUnfurl::getContent()` function. The issue arises because the `setIsAPIRequest(true)` function is called unconditionally before credential verification, allowing an attacker to bypass the token gatekeeper by providing any non-empty values for the `X-IDNO-USERNAME` and `X-IDNO-SIGNATURE` headers. This allows access to internal services and potential exfiltration of sensitive information, such as cloud instance metadata. **Recommendations** Versions prior to 1.6.4 should be updated to version 1.6.4 or later. Move `setIsAPIRequest(true)` to after successful HMAC verification. Block private address ranges in the unfurl function to prevent requests to RFC 1918 addresses, loopback, and link-local ranges.
PT-2026-21771
6.1
2026-02-24
Unknown · Leafletlayer · CVE-2026-27156
**Nome do Software Vulnerável e Versões Afetadas** Versões do NiceGUI anteriores à 3.8.0 **Descrição** As APIs do NiceGUI, incluindo `Element.run method()`, `AgGrid.run grid method()`, `EChart.run chart method()` e outras, utilizavam um fallback `eval()` dentro da função JavaScript `runMethod()`. Isso permitia a execução arbitrária de JavaScript no navegador da vítima quando uma entrada controlada pelo usuário era fornecida como nome do método. Além disso, `Element.run method()` e `Element.get computed prop()` utilizavam interpolação de strings em vez de `json.dumps()` para nomes de métodos/propriedades, permitindo a injeção de aspas para contornar o contexto de string pretendido. Um atacante poderia criar uma URL maliciosa com um payload como parâmetro de consulta e, se o aplicativo passasse esse parâmetro como nome do método para qualquer uma das APIs afetadas, o payload seria enviado ao cliente via WebSocket e executado. Isso poderia levar ao roubo de cookies/tokens, manipulação do DOM e ações realizadas como o usuário vítima. Os métodos afetados incluem: `Element.run method()`, `Element.get computed prop()`, `AgGrid.run grid method()`, `AgGrid.run row method()`, `EChart.run chart method()`, `JsonEditor.run editor method()`, `Xterm.run terminal method()`, `Leaflet.run map method()`, `Leaflet.run layer method()` e `LeafletLayer.run method()`. **Recomendações** Atualize para a versão 3.8.0 ou superior do NiceGUI. Caso a atualização não seja possível imediatamente, utilize `ui.run javascript()` em vez de passar funções JavaScript como nomes de métodos. Por exemplo, substitua `row = await grid.run grid method('g => g.getDisplayedRowAtIndex(0).data')` por `row = await ui.run javascript(f'return getElement({grid.id}).api.getDisplayedRowAtIndex(0).data')`.