Mnqazi

Nome do software vulnerável e versões afetadas: versões do python-multipart anteriores à 0.0.18 Descrição: O problema surge durante a análise de dados de formulário, pois o python-multipart ignora as quebras de linha antes do primeiro delimitador e quaisquer bytes finais após o último delimitador, um byte de cada vez, gerando um evento de log a cada vez. Isso pode causar um registro excessivo de logs para determinadas entradas. Um invasor poderia explorar isso enviando uma solicitação maliciosa com muitos dados antes do primeiro ou após o último delimitador, causando alta carga na CPU e paralisando a thread de processamento. No caso de um aplicativo ASGI, isso poderia paralisar o loop de eventos e impedir que outras solicitações fossem processadas, resultando em uma negação de serviço. Recomendações: Para versões do python-multipart anteriores à 0.0.18, atualize para a versão 0.0.18 para resolver o problema. Como solução temporária, considere restringir a quantidade de dados que podem ser enviados antes do primeiro ou após o último limite para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Kiwi TCMS versions prior to 12.5 **Description** The issue is related to the upload of attachments to test plans and test cases in Kiwi TCMS. Earlier versions of Kiwi TCMS had changes to serve all uploaded files as plain text to prevent browsers from executing potentially dangerous files. However, the previous Nginx configuration was incorrect, allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions, thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code required additional sanitation and improvements. The `tree view html()` function also needed sanitization of test plan names. **Recommendations** For versions prior to 12.5, update to version 12.5, which includes an updated Nginx content type configuration, improved file upload validation code, and sanitization of test plan names used in the `tree view html()` function. As a temporary workaround, consider restricting file uploads and access to potentially dangerous files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Kiwi TCMS versions prior to 12.4 **Description** The issue is related to the lack of protection of the web page structure in Kiwi TCMS, allowing a remote attacker to upload arbitrary attachments to test plans and test cases. Earlier versions of Kiwi TCMS had introduced upload validators and Content-Security-Policy definitions to prevent cross-site-scripting attacks, but the upload validation checks were not robust, leaving the possibility to circumvent them and upload potentially dangerous files. This allows the execution of arbitrary JavaScript in the browser. Additionally, Nginx's `proxy pass` directive can strip some headers, negating protections built into Kiwi TCMS when served behind a reverse proxy. **Recommendations** For versions prior to 12.4, upgrade to version 12.4 or later to address the issue. For users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy, make sure that additional header values are still passed to the client browser. If they aren't, redefine them inside the proxy configuration. As a temporary workaround, consider improving file upload validation code and updating Nginx reverse proxy configuration to prevent exploitation.