Copilot
Monthly
Unauthenticated attackers can install detection-suppression rules in SOCFortress CoPilot deployments before 0.1.77 because the Velociraptor Sigma exclusion endpoints never actually validate the bearer token they receive: an arbitrary, expired or forged value is decoded into a sentinel string ('Invalid token' / 'Expired signature') that is stored as the rule's creator instead of rejecting the request. A rule created with a null customer_code applies to every tenant, so matching Sigma alerts are silently dropped by process_sigma_alert before an incident is ever created, and any authenticated user down to the lowest-privilege customer_user role can additionally list, read, update, toggle and delete every exclusion because those routes carry no scope or tenant check. Version 0.1.77 fixes both paths. No confirmed active exploitation (not in CISA KEV) is reported, but the vendor advisory publishes a detailed two-step proof-of-concept reference for the unauthenticated create path that has not been independently validated here as working exploit code.
Arbitrary host file write as root in SOCFortress CoPilot prior to 0.1.77: the ScoutSuite GCP report upload endpoint accepts a caller-supplied multipart filename and joins it with os.path.join into the scoutsuite-report directory, so a '../'-laden filename escapes the intended folder and writes attacker-controlled bytes anywhere the backend process can reach. Exploitation requires a valid analyst- or admin-scoped bearer token (the assessed vector is PR:L, not the PR:N shown in the original CVSS string) plus an uploaded body that passes GCPScoutSuiteJSON content validation, which a syntactically valid GCP service-account JSON satisfies trivially; because the published backend image runs as root, writes land root-owned in /tmp and in the application source directory. A proof-of-concept documented as confirmed live against the published ghcr.io/socfortress/copilot-backend image is public, and escalation to code execution depends on choosing an exploitable destination such as a cron directory, a loaded Python module or a startup script; the advisory's broader claims of unrestricted-content and unconditional cross-tenant compromise are not established by the demonstrated primitive. The issue is rated act_now because a working write primitive with root privileges in a default deployment is a direct path to full platform and stored connector-credential compromise, though the mandatory authentication, JSON content validation and non-root deployment architecture are genuine limiting factors. No CISA KEV entry is associated with this CVE.
Unauthenticated disclosure of cloud credentials and audit data in SOCFortress CoPilot stems from the `/scoutsuite-report` StaticFiles mount, which bypasses the JWT protection applied to every `/api/...` route. During an admin- or analyst-initiated GCP scan, the platform writes the uploaded Google service-account JSON key into that web-served directory and deletes it only after the scan finishes, so any remote client that can reach the host can fetch the live private key at a predictable path for the scan duration; retained ScoutSuite HTML and `scoutsuite_results_<name>.js` files are likewise readable and expose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. No authentication, user interaction or special capability is required (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C, score 9.3), and the advisory ships a reproduction confirmed against the published `ghcr.io/socfortress/copilot-backend:latest` image; realistic exposure is bounded by the need for an active scan window (key theft) or a retained report (posture disclosure). SOCFortress released credential isolation in v0.1.77, but a release fully remediating the report-disclosure component has not been established.
Unauthenticated active-response invocation and alert injection affect SOCFortress CoPilot deployments prior to 0.1.76 that leave GRAYLOG_API_HEADER_VALUE or VELOCIRAPTOR_API_HEADER_VALUE unset or unchanged, because both webhook header validators fall back to the same public constant shipped in `.env.example`. A remote attacker who supplies that known header value bypasses the JWT authentication that gates every other API, reaching POST /api/graylog/invoke to forward attacker-chosen COMMAND, ACTION, VALUE and AGENT_ID to the configured Wazuh manager (without the command-enum validation enforced on the authenticated invocation route), and reaching the threshold and velo-sigma alert routes to forge alerts for arbitrary customer_code values and drive attacker-controlled OpenSearch queries. The vendor's own advisory reports a confirmed live proof of concept against the published copilot-backend image; no CISA KEV entry is recorded and no EPSS score was supplied, but the priority decision label is act_now given the default-deployment exposure. Active-response delivery additionally requires a configured reachable Wazuh manager, and deployments that independently changed both header secrets are not subject to this bypass.
Stored cross-site scripting in SOCFortress CoPilot lets any authenticated portal user, including the lowest-privilege customer_user role, plant HTML/JavaScript through POST /api/incidents/db_operations/alert/comment that is later rendered unsanitized via v-html in AlertComment.vue, executing on the application origin whenever a viewer opens the poisoned alert. Because the customer portal persists access and refresh tokens in JavaScript-readable storage and sends them as bearer headers rather than HttpOnly cookies, an injected script can read both tokens and mint fresh ones through /auth/refresh, so an analyst or administrator who views the poisoned content hands over a persistent privileged session, enabling cross-tenant data access, incident modification or deletion, and subversion of detection and response. Snapshots preceding 0.1.70 (health-check sink) and 0.1.76 (comment and other SOC sinks) are affected, the vendor advisory includes a proof-of-concept demonstrated live against the published ghcr.io/socfortress/copilot-backend image, and priority is act_now. Per the assessed vector the attacker must be authenticated (PR:L) and the issue is scored at 9.9 with scope change.
Cross-tenant object-store writes in SOCFortress CoPilot before 0.1.76 let any authenticated customer_user (customer-portal) account overwrite arbitrary objects in any bucket - including other tenants' case evidence and forensic artifacts, the Sysmon configuration distributed to managed Windows endpoints, and the report templates rendered server-side - because the upload route accepts caller-controlled bucket and object names with no allow-list, no tenant prefix, no ownership check and no content validation. The write is an unconditional upsert that creates missing buckets on demand, so the lowest-privilege role can blind endpoint telemetry, tamper with cross-tenant evidence, poison report templates for later server-side rendering, plant data or exhaust storage. The reporter published a confirmed live proof-of-concept with reproduction steps against the published ghcr.io/socfortress/copilot-backend:latest image; no CISA KEV entry or other active-exploitation reporting is present, and 0.1.76 fixes the issue by restricting the upload route to admin/analyst scopes.
Stored server-side template injection in SOCFortress CoPilot before 0.1.76 allows a customer_user - the lowest-privilege portal role - to upload a malicious DOCX or HTML case-report template into a global, unscoped store and replace a legitimate default template under the same name. When an admin or analyst later generates a report through /api/incidents/report/generate-report-docx or /generate-report-pdf, the non-sandboxed Jinja2 engine evaluates the attacker's expressions as Python, yielding remote code execution that the advisory confirms as root in the reported deployment. The advisory includes a confirmed live proof-of-concept against the published backend image, the issue is prioritized as act_now, and no CISA KEV entry is provided.
Authentication bypass in SOCFortress CoPilot versions prior to 0.1.57 allows remote unauthenticated attackers to forge admin-scoped JWT tokens and gain full control of the security operations platform. The application ships with a publicly known JWT signing secret hardcoded as a fallback value (bL4unrkoxtFs1MT6A7Ns2yMLkduyuqrkTxDV9CjlbNc=) in backend/app/auth/utils.py and .env.example. Any deployment using the default Docker Compose setup or where JWT_SECRET is not explicitly set signs all authentication tokens with this known value, enabling attackers to impersonate administrators and control every integrated security tool without credentials. CVSS 10.0 with network vector and no authentication required. Fix confirmed in version 0.1.57 via GitHub commit 4640511a0cf2e7b144a71375b5b349a8318cb186.
Command injection in Microsoft Copilot allows an attacker to disclose confidential information when a victim invokes Copilot on attacker-controlled content containing improperly neutralized special elements. Exploitation requires the victim to trigger Copilot against the malicious content (UI:R) and depends on precise crafting to defeat the assistant's neutralization logic (AC:H), so it cannot be triggered unilaterally by the attacker, though no authentication is required of the attacker (PR:N). The flaw crosses a security boundary to expose highly confidential data with no integrity or availability impact (CVSS 3.1 base 6.1; S:C/C:H/I:N/A:N); there is confirmed actively exploited (CISA KEV) - no public exploit identified at time of analysis, and the underlying service has been remediated server-side, making residual real-world risk moderate and skewed toward opportunistic data theft rather than mass exploitation.
Unauthenticated attackers can install detection-suppression rules in SOCFortress CoPilot deployments before 0.1.77 because the Velociraptor Sigma exclusion endpoints never actually validate the bearer token they receive: an arbitrary, expired or forged value is decoded into a sentinel string ('Invalid token' / 'Expired signature') that is stored as the rule's creator instead of rejecting the request. A rule created with a null customer_code applies to every tenant, so matching Sigma alerts are silently dropped by process_sigma_alert before an incident is ever created, and any authenticated user down to the lowest-privilege customer_user role can additionally list, read, update, toggle and delete every exclusion because those routes carry no scope or tenant check. Version 0.1.77 fixes both paths. No confirmed active exploitation (not in CISA KEV) is reported, but the vendor advisory publishes a detailed two-step proof-of-concept reference for the unauthenticated create path that has not been independently validated here as working exploit code.
Arbitrary host file write as root in SOCFortress CoPilot prior to 0.1.77: the ScoutSuite GCP report upload endpoint accepts a caller-supplied multipart filename and joins it with os.path.join into the scoutsuite-report directory, so a '../'-laden filename escapes the intended folder and writes attacker-controlled bytes anywhere the backend process can reach. Exploitation requires a valid analyst- or admin-scoped bearer token (the assessed vector is PR:L, not the PR:N shown in the original CVSS string) plus an uploaded body that passes GCPScoutSuiteJSON content validation, which a syntactically valid GCP service-account JSON satisfies trivially; because the published backend image runs as root, writes land root-owned in /tmp and in the application source directory. A proof-of-concept documented as confirmed live against the published ghcr.io/socfortress/copilot-backend image is public, and escalation to code execution depends on choosing an exploitable destination such as a cron directory, a loaded Python module or a startup script; the advisory's broader claims of unrestricted-content and unconditional cross-tenant compromise are not established by the demonstrated primitive. The issue is rated act_now because a working write primitive with root privileges in a default deployment is a direct path to full platform and stored connector-credential compromise, though the mandatory authentication, JSON content validation and non-root deployment architecture are genuine limiting factors. No CISA KEV entry is associated with this CVE.
Unauthenticated disclosure of cloud credentials and audit data in SOCFortress CoPilot stems from the `/scoutsuite-report` StaticFiles mount, which bypasses the JWT protection applied to every `/api/...` route. During an admin- or analyst-initiated GCP scan, the platform writes the uploaded Google service-account JSON key into that web-served directory and deletes it only after the scan finishes, so any remote client that can reach the host can fetch the live private key at a predictable path for the scan duration; retained ScoutSuite HTML and `scoutsuite_results_<name>.js` files are likewise readable and expose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. No authentication, user interaction or special capability is required (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C, score 9.3), and the advisory ships a reproduction confirmed against the published `ghcr.io/socfortress/copilot-backend:latest` image; realistic exposure is bounded by the need for an active scan window (key theft) or a retained report (posture disclosure). SOCFortress released credential isolation in v0.1.77, but a release fully remediating the report-disclosure component has not been established.
Unauthenticated active-response invocation and alert injection affect SOCFortress CoPilot deployments prior to 0.1.76 that leave GRAYLOG_API_HEADER_VALUE or VELOCIRAPTOR_API_HEADER_VALUE unset or unchanged, because both webhook header validators fall back to the same public constant shipped in `.env.example`. A remote attacker who supplies that known header value bypasses the JWT authentication that gates every other API, reaching POST /api/graylog/invoke to forward attacker-chosen COMMAND, ACTION, VALUE and AGENT_ID to the configured Wazuh manager (without the command-enum validation enforced on the authenticated invocation route), and reaching the threshold and velo-sigma alert routes to forge alerts for arbitrary customer_code values and drive attacker-controlled OpenSearch queries. The vendor's own advisory reports a confirmed live proof of concept against the published copilot-backend image; no CISA KEV entry is recorded and no EPSS score was supplied, but the priority decision label is act_now given the default-deployment exposure. Active-response delivery additionally requires a configured reachable Wazuh manager, and deployments that independently changed both header secrets are not subject to this bypass.
Stored cross-site scripting in SOCFortress CoPilot lets any authenticated portal user, including the lowest-privilege customer_user role, plant HTML/JavaScript through POST /api/incidents/db_operations/alert/comment that is later rendered unsanitized via v-html in AlertComment.vue, executing on the application origin whenever a viewer opens the poisoned alert. Because the customer portal persists access and refresh tokens in JavaScript-readable storage and sends them as bearer headers rather than HttpOnly cookies, an injected script can read both tokens and mint fresh ones through /auth/refresh, so an analyst or administrator who views the poisoned content hands over a persistent privileged session, enabling cross-tenant data access, incident modification or deletion, and subversion of detection and response. Snapshots preceding 0.1.70 (health-check sink) and 0.1.76 (comment and other SOC sinks) are affected, the vendor advisory includes a proof-of-concept demonstrated live against the published ghcr.io/socfortress/copilot-backend image, and priority is act_now. Per the assessed vector the attacker must be authenticated (PR:L) and the issue is scored at 9.9 with scope change.
Cross-tenant object-store writes in SOCFortress CoPilot before 0.1.76 let any authenticated customer_user (customer-portal) account overwrite arbitrary objects in any bucket - including other tenants' case evidence and forensic artifacts, the Sysmon configuration distributed to managed Windows endpoints, and the report templates rendered server-side - because the upload route accepts caller-controlled bucket and object names with no allow-list, no tenant prefix, no ownership check and no content validation. The write is an unconditional upsert that creates missing buckets on demand, so the lowest-privilege role can blind endpoint telemetry, tamper with cross-tenant evidence, poison report templates for later server-side rendering, plant data or exhaust storage. The reporter published a confirmed live proof-of-concept with reproduction steps against the published ghcr.io/socfortress/copilot-backend:latest image; no CISA KEV entry or other active-exploitation reporting is present, and 0.1.76 fixes the issue by restricting the upload route to admin/analyst scopes.
Stored server-side template injection in SOCFortress CoPilot before 0.1.76 allows a customer_user - the lowest-privilege portal role - to upload a malicious DOCX or HTML case-report template into a global, unscoped store and replace a legitimate default template under the same name. When an admin or analyst later generates a report through /api/incidents/report/generate-report-docx or /generate-report-pdf, the non-sandboxed Jinja2 engine evaluates the attacker's expressions as Python, yielding remote code execution that the advisory confirms as root in the reported deployment. The advisory includes a confirmed live proof-of-concept against the published backend image, the issue is prioritized as act_now, and no CISA KEV entry is provided.
Authentication bypass in SOCFortress CoPilot versions prior to 0.1.57 allows remote unauthenticated attackers to forge admin-scoped JWT tokens and gain full control of the security operations platform. The application ships with a publicly known JWT signing secret hardcoded as a fallback value (bL4unrkoxtFs1MT6A7Ns2yMLkduyuqrkTxDV9CjlbNc=) in backend/app/auth/utils.py and .env.example. Any deployment using the default Docker Compose setup or where JWT_SECRET is not explicitly set signs all authentication tokens with this known value, enabling attackers to impersonate administrators and control every integrated security tool without credentials. CVSS 10.0 with network vector and no authentication required. Fix confirmed in version 0.1.57 via GitHub commit 4640511a0cf2e7b144a71375b5b349a8318cb186.
Command injection in Microsoft Copilot allows an attacker to disclose confidential information when a victim invokes Copilot on attacker-controlled content containing improperly neutralized special elements. Exploitation requires the victim to trigger Copilot against the malicious content (UI:R) and depends on precise crafting to defeat the assistant's neutralization logic (AC:H), so it cannot be triggered unilaterally by the attacker, though no authentication is required of the attacker (PR:N). The flaw crosses a security boundary to expose highly confidential data with no integrity or availability impact (CVSS 3.1 base 6.1; S:C/C:H/I:N/A:N); there is confirmed actively exploited (CISA KEV) - no public exploit identified at time of analysis, and the underlying service has been remediated server-side, making residual real-world risk moderate and skewed toward opportunistic data theft rather than mass exploitation.