Liad-Miggo

**Name of the Vulnerable Software and Affected Versions** Langchain Helm Charts versions prior to 0.12.71 **Description** Langchain Helm Charts, used for deploying Langchain applications on Kubernetes, had a flaw where a specially crafted link could lead to the theft of authentication tokens. This allowed an attacker to impersonate a user and gain access to LangSmith resources. The attack required convincing a user to click a malicious link, transmitting their bearer token, user ID, and workspace ID to an attacker-controlled server. The stolen tokens were valid for approximately 5 minutes. The issue affected both LangSmith Cloud and self-hosted deployments. The vulnerability stemmed from a lack of validation of the `baseUrl` parameter, allowing tokens to be sent to unauthorized servers. **Recommendations** Upgrade to version 0.12.71 or later to implement validation requiring user-defined allowed origins for the `baseUrl` parameter.

Name of the Vulnerable Software and Affected Versions: Stroom versions 7.2-beta.53 through 7.2.23 Stroom versions prior to 7.3-beta.22 Stroom versions prior to 7.4.4 Stroom versions prior to 7.5-beta.2 Description: The issue concerns a data processing, storage, and analysis platform. A vulnerability exists that allows authentication bypass to the system when configured with ALB and installed in a way that the application is accessible not through the ALB itself. This vulnerability may also allow for server-side request forgery, which may lead to code execution or further privileges escalations when using the AWS metadata URL. The scenario assumes that the platform must be configured to use ALB Authentication integration and the application is network accessible. Recommendations: For versions 7.2-beta.53 through 7.2.23, update to version 7.2.24 or later. For versions prior to 7.3-beta.22, update to version 7.3-beta.22 or later. For versions prior to 7.4.4, update to version 7.4.4 or later. For versions prior to 7.5-beta.2, update to version 7.5-beta.2 or later. As a temporary workaround, consider restricting access to the ALB authentication integration until a patch is available. Avoid using the AWS metadata URL in the affected platform until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Amazon.ApplicationLoadBalancer.Identity.AspNetCore (affected versions not specified) **Description** The issue concerns the Amazon.ApplicationLoadBalancer.Identity.AspNetCore repository, which contains middleware for use with the Application Load Balancer (ALB) OpenId Connect integration in ASP.NET Core deployment scenarios. The middleware performs signature validation but fails to validate the JWT issuer and signer identity. This omission can allow an untrusted entity to sign JWTs and potentially mimic valid OIDC-federated sessions to the ALB targets if the infrastructure owner allows internet traffic to the ALB targets. It is recommended to ensure that ELB targets do not have public IP addresses. **Recommendations** As a temporary workaround, consider validating the signer attribute in the JWT to match the ARN of the Application Load Balancer that the service is configured to use. Ensure any forked or derivative code includes this validation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: AWS ALB Route Directive Adapter For Istio (affected versions not specified) Description: The issue concerns a lack of proper signer and issuer validation in the JWT authentication mechanism used by the AWS ALB Route Directive Adapter For Istio. This allows an actor to provide a JWT signed by an untrusted entity, potentially spoofing OIDC-federated sessions and bypassing authentication in deployments where ALB targets are directly exposed to internet traffic. The repository has been deprecated and is no longer supported. As a security best practice, it is recommended to ensure ELB targets do not have public IP addresses. Recommendations: As a temporary workaround, consider validating that the signer attribute in the JWT matches the ARN of the Application Load Balancer that the service is configured to use. Ensure any forked or derivative code implements proper signer and issuer validation for JWT authentication. Restrict access to ELB targets, such as EC2 Instances or Fargate Tasks, to minimize the risk of exploitation by not assigning them public IP addresses. At the moment, there is no information about a newer version that contains a fix for this vulnerability.