pyuysig

Summary

Datadog Vector 0.54.0 can build a ClickHouse INSERT query from a database template rendered with event data. When that template uses an attacker-controlled event field, the rendered database identifier can break out of the quoted identifier context and redirect writes to another ClickHouse table reachable by Vector's credential.

Details

The ClickHouse sink accepts both table and database as Template values in src/sinks/clickhouse/config.rs. At runtime, KeyPartitioner::partition in src/sinks/clickhouse/sink.rs renders those templates per event before the batch is sent.

The rendered values are passed into set_uri_query in src/sinks/clickhouse/service.rs. That function builds the HTTP query parameter with the SQL shape INSERT INTO "<database>"."<table>" FORMAT <format>.

The escaping is asymmetric. The table value is passed through table.replace('"', "\""), but the database value is inserted into the SQL string without the same quote escaping. URL encoding the HTTP

pyuysig

Summary

Datadog Vector 0.54.0 can buffer or decompress selected HTTP and gRPC ingest bodies before an effective expanded-size boundary is enforced. A remote client accepted by an exposed source can use oversized or highly compressed input to drive memory exhaustion.

Details

The affected paths sit in Vector's source-side request handling, including HTTP source utilities, OpenTelemetry HTTP, Splunk HEC, Vector source handling, and gRPC decompression helpers. The HTTP path accepts request bytes through framework body collection before the source-specific limit can reject the fully materialized body.

Compression handling creates the more direct trust-boundary issue. Helpers used by the HTTP and gRPC ingest paths decode compressed attacker-controlled bytes into memory with no output-size cap tied to the configured request limit. The limit is therefore applied after the allocation boundary that matters for denial of service.

The attacker controls the request body and the compression format accepted by th

pyuysig

Summary

Bludit 3.19.0 writes API-uploaded page files using the client-supplied multipart filename. An authenticated administrator can include path traversal in that filename and write files outside the intended page upload directory.

Details

The API upload path in bl-plugins/api/plugin.php::uploadFile() reads $_FILES['file']['name'] into $filename. It then builds the destination as PATH_UPLOADS_PAGES . $pageKey . DS . $filename and moves the uploaded file there.

The handler blocks a small set of direct script extensions, but it does not normalize path components or reject .. segments before the filesystem write. The attacker-controlled multipart filename therefore crosses from HTTP metadata into a server path append operation.

API authentication and an administrator authentication token are still required. Once those checks pass, a filename such as ../../../../.htaccess or ../../../../.user.ini is not confined to the page upload directory.

pyuysig

Summary

Whoogle Search 1.2.3 exposes configured Google Custom Search Engine BYOK credentials through configuration and preference rendering paths. A remote user can read cse_api_key and cse_id values when they are configured for the instance.

Details

The configuration model keeps cse_api_key and cse_id outside the safe preference-key set. The GET /config route returns g.user_config.__dict__, which includes those fields when they are present.

The same values can also be rendered into client-visible state. The index and header templates render CSE configuration into form state, and the encoded preferences value used by / and /search can contain the same BYOK fields.

WHOOGLE_CONFIG_DISABLE=1 blocks configuration changes, but it does not remove these fields from GET /config or from already rendered preference state. The trust boundary is therefore read exposure of server-side configured API credentials to ordinary visitors.

pyuysig

Summary

Reminiscence 0.3.0 stores an authenticated user's download_manager setting and later executes it through Windows shell-based subprocess paths. A user who controls that setting can inject commands when media archiving or export functionality invokes the configured downloader.

Details

The settings update flow in pages/views.py accepts req_set_settings=yes and stores the submitted download_manager value for the user. Later, media archiving and export helpers in pages/dbaccess.py format that stored value with fields such as {iurl} and {output}.

On Windows, the resulting string is passed to subprocess helpers with shell=True. The missing boundary is validation that download_manager is a safe executable path and argument template before it becomes a shell command.

The issue requires an authenticated account that can save the setting and a Windows deployment path that invokes the stored downloader. Non-Windows execution paths are not part of this command-injection claim.

pyuysig

Summary

selfoss 2.20 can trust external requests as local when it runs behind a same-host reverse proxy that does not preserve forwarding headers. Under that deployment condition, an unauthenticated external requester can create sources and trigger server-side URL fetches.

Details

AuthenticationFactory::create() selects the Trust authentication implementation when isLocalIp() sees a loopback REMOTE_ADDR and no forwarded address headers. Trust returns privileged decisions for read, update, and privileged checks.

The source creation path reaches Sources\Write::write() through POST /source and relies on ensureIsPrivileged() before persisting a source. If a reverse proxy makes external requests appear to originate from loopback without setting X-Forwarded-For or Forwarded, an external requester receives that trusted local authorization state.

The attacker-controlled inputs are the source type, source parameters, and feed URL. When the submitted source title is empty, the source hand

pyuysig

Summary

flatnotes 5.5.4 accepts authenticated attachment uploads with active web content extensions and serves them from the application origin. A user who can upload an attachment can store same-origin executable content as an attachment.

Details

The attachment API routes include /api/attachments/{filename} and /attachments/{filename}. The filesystem attachment backend validates filename shape but does not restrict active extensions such as .html or .svg.

The stored file is returned through FileResponse. For browser-active file types, the response can be served as text/html or image/svg+xml, so the attachment is interpreted in the flatnotes origin instead of being forced to download or rendered as inert text.

The attacker-controlled inputs are the attachment filename and body. The missing rule is an extension/content-type policy that prevents active attachments from being served as same-origin executable documents.

pyuysig

Summary

Shaark 1.2.44 stores administrator-controlled binary path settings and later concatenates those values into shell commands in feature-check endpoints. An administrator can inject shell metacharacters into node_bin or youtube_dl_bin and execute commands on the server.

Details

Shaark stores archive-related binary paths such as node_bin, youtube_dl_bin, and related interpreter paths as configuration values. The relevant setting validation requires values to be present, but it does not constrain them to safe executable paths.

GET /api/manage/features/pdf and GET /api/manage/features/media load those configured values in FeaturesController and call exec($exec . ' --version'). The attacker-controlled setting is therefore treated as the beginning of a shell command.

This path requires an administrator or equivalent settings-capable user. The trust boundary break is the jump from application configuration to host shell execution through exec().

pyuysig

Summary

Deck9 Input 2.0.1 authorizes webhook mutations against the parent form in the route but applies the mutation to an independently bound webhook object. An authenticated user can update or delete another form's webhook when they know its webhook identifier.

Details

The affected API routes are shaped as forms/{form}/webhooks/{webhook}. The request and controller authorization checks validate access to the supplied {form} route parameter.

The {webhook} route parameter is resolved as a separate model and is not scoped to the parent form. FormWebhookController::update() then calls $webhook->update($request->validated()), and the delete path authorizes against the form before deleting the route-bound webhook object.

The ownership check is performed on formA, but the mutation applies to webhookB. The missing rule is scoped route binding or an explicit check that the webhook belongs to the authorized form before update or delete.

pyuysig

Summary

Deck9 Input 2.0.1 stores webhook response bodies and later renders them in the submission webhook status UI as HTML. A webhook endpoint controlled by an attacker can return active content that becomes stored script content for users viewing the status page.

Details

CallWebhookJob sends the configured webhook request and stores the response body. FormSessionWebhookResource exposes the stored response value to the frontend for submission webhook status display.

The frontend status component renders the webhook response in the status view instead of preserving it as inert text. The attacker-controlled input is the HTTP response body returned by a configured webhook URL, not a normal form field.

The trust boundary is crossed when a remote server response, originally collected by the backend during webhook delivery, is displayed to authenticated application users as HTML.