Bbs Go
Monthly
bbs-go through 4.4.6 disables TLS certificate verification when sending SMTP email, so a network-positioned attacker who can intercept the connection between the bbs-go server and its configured mail server can present any certificate and be trusted. Interception exposes SMTP PLAIN authentication credentials and lets the attacker read or tamper with outgoing password-reset and account-verification messages. The flaw requires an active man-in-the-middle position plus a bbs-go deployment that sends mail over a TLS/STARTTLS SMTP connection; no authentication or user interaction against bbs-go itself is needed once that position exists, and no public exploit code was identified at the time of analysis.
Account takeover of Google-linked bbs-go users is possible because the /api/login/google_one_tap endpoint accepts any Google-signed ID token without ever validating its audience (aud) claim, so the login handler trusts tokens minted for OAuth clients other than the site's own. An attacker who operates their own Google OAuth client can get a victim to sign in at an attacker-controlled property, capture the resulting Google-signed ID token, and replay it against bbs-go to obtain an authenticated session tied to the victim's Google-linked account (CWE-287). The flaw affects bbs-go through version 4.4.6 on instances where Google One Tap login is enabled and the target account is Google-linked; no public exploit identified at time of analysis, although a public technical writeup of the audience-confusion technique is referenced, and exploitation requires victim interaction to obtain a valid token.
Authenticated users with only the read-only dashboard.user.view permission in bbs-go through 4.4.6 can reach the /api/admin/user/synccount endpoint because AdminMiddleware matches the view permission rule before the intended dashboard.user.update rule. Repeated calls trigger expensive full-table user recounts and cache invalidations, causing low-impact denial of service through concurrent database work. No public exploit was identified at time of analysis, and an upstream patch commit is available from the vendor.
Cross Site Scripting vulnerability in mlogclub bbs-go v. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in mlogclub bbs-go v. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
bbs-go through 4.4.6 disables TLS certificate verification when sending SMTP email, so a network-positioned attacker who can intercept the connection between the bbs-go server and its configured mail server can present any certificate and be trusted. Interception exposes SMTP PLAIN authentication credentials and lets the attacker read or tamper with outgoing password-reset and account-verification messages. The flaw requires an active man-in-the-middle position plus a bbs-go deployment that sends mail over a TLS/STARTTLS SMTP connection; no authentication or user interaction against bbs-go itself is needed once that position exists, and no public exploit code was identified at the time of analysis.
Account takeover of Google-linked bbs-go users is possible because the /api/login/google_one_tap endpoint accepts any Google-signed ID token without ever validating its audience (aud) claim, so the login handler trusts tokens minted for OAuth clients other than the site's own. An attacker who operates their own Google OAuth client can get a victim to sign in at an attacker-controlled property, capture the resulting Google-signed ID token, and replay it against bbs-go to obtain an authenticated session tied to the victim's Google-linked account (CWE-287). The flaw affects bbs-go through version 4.4.6 on instances where Google One Tap login is enabled and the target account is Google-linked; no public exploit identified at time of analysis, although a public technical writeup of the audience-confusion technique is referenced, and exploitation requires victim interaction to obtain a valid token.
Authenticated users with only the read-only dashboard.user.view permission in bbs-go through 4.4.6 can reach the /api/admin/user/synccount endpoint because AdminMiddleware matches the view permission rule before the intended dashboard.user.update rule. Repeated calls trigger expensive full-table user recounts and cache invalidations, causing low-impact denial of service through concurrent database work. No public exploit was identified at time of analysis, and an upstream patch commit is available from the vendor.
Cross Site Scripting vulnerability in mlogclub bbs-go v. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability in mlogclub bbs-go v. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.