Bloodhound
Monthly
Improper authorization in SpecterOps BloodHound through 9.4.0 lets any authenticated user tamper with the global custom-node graph schema by calling POST, PUT, and DELETE operations on the /api/v2/custom-nodes endpoints, which enforced only that a caller was logged in rather than that they held write permissions. Because custom node kinds are a shared, tenant-wide schema construct, a single low-privileged account can create, alter, or delete node types that affect every user and tenant on the instance. Publicly available exploit code exists and a vendor patch (commit 8f79035) is available; there is no CISA KEV listing, so exploitation is not confirmed as active.
Improper authorization in SpecterOps BloodHound through version 9.5.1 allows authenticated users holding only GraphDBRead permissions to invoke the PATCH /api/v2/domains/{objectID} write endpoint, effectively bypassing the intended write-permission gate. The commit diff confirms the root cause: the route handler called RequirePermissions(permissions.GraphDBRead) where it should have enforced GraphDBWrite, granting read-only users unauthorized ability to modify domain objects in the BloodHound graph database. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 5.3 (PR:L) reflects the authentication prerequisite that limits the attack surface to already-authenticated principals.
components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper authorization in SpecterOps BloodHound through 9.4.0 lets any authenticated user tamper with the global custom-node graph schema by calling POST, PUT, and DELETE operations on the /api/v2/custom-nodes endpoints, which enforced only that a caller was logged in rather than that they held write permissions. Because custom node kinds are a shared, tenant-wide schema construct, a single low-privileged account can create, alter, or delete node types that affect every user and tenant on the instance. Publicly available exploit code exists and a vendor patch (commit 8f79035) is available; there is no CISA KEV listing, so exploitation is not confirmed as active.
Improper authorization in SpecterOps BloodHound through version 9.5.1 allows authenticated users holding only GraphDBRead permissions to invoke the PATCH /api/v2/domains/{objectID} write endpoint, effectively bypassing the intended write-permission gate. The commit diff confirms the root cause: the route handler called RequirePermissions(permissions.GraphDBRead) where it should have enforced GraphDBWrite, granting read-only users unauthorized ability to modify domain objects in the BloodHound graph database. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 5.3 (PR:L) reflects the authentication prerequisite that limits the attack surface to already-authenticated principals.
components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.