Ech0

Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the admin's password via a misauthorized PUT /user endpoint, then authenticate to obtain an unrestricted session token that bypasses all scope enforcement. The CWE-863 root cause is a mismatch between the declared read-only scope on the route and the write operations the handler actually performs; session tokens produced after login skip scope checks entirely, granting full admin API access. Publicly available exploit code exists per the GHSA advisory; no confirmed active exploitation in CISA KEV at time of analysis.

Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - regardless of its configured permission scope - to perform unrestricted comment moderation operations across nine unprotected endpoints. All versions of Ech0 before 4.4.3 (CPE: cpe:2.3:a:lin-snow:ech0:*) are affected; the comment router omits the RequireScopes() middleware that every other admin route group in the application applies per-handler. No public exploit has been identified at time of analysis, but exploitation complexity is low for any attacker already holding a scoped access token, making upgrade to 4.4.3 the immediate priority.

Server-side request forgery in Ech0 through 4.2.1 (Go-based self-hosted application by lin-snow) allows an authenticated admin to exfiltrate data from internal network services and cloud metadata endpoints by exploiting a DNS resolution bypass in webhook URL validation. The validateWebhookURL function checks only literal IP strings via net.ParseIP(), so hostnames like 169.254.169.254.nip.io pass validation unchallenged and DNS-resolve to private IPs at request time. Publicly available exploit code exists (curl-based PoC in GHSA-r2x7-427f-rq69); no confirmed active exploitation (not in CISA KEV). The CVSS 4.0 score of 5.1 reflects the PR:H prerequisite, which substantially limits real-world exposure.

Stored cross-site scripting in Ech0 before 4.4.3 allows authenticated administrators to upload SVG or HTML files containing arbitrary JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and credential exfiltration. The file upload handler at internal/service/file/file.go trusts the client-supplied multipart Content-Type header without server-side magic byte detection or extension validation, and SVG uploads are permitted in the default AllowedTypes configuration without any bypass required. Uploaded files are served publicly without authentication via a gin.Static route, meaning any user - authenticated or not - who visits the file URL triggers execution. Vendor-released patch 4.4.3 is available; no public exploit has been identified at time of analysis.

Log endpoint access control in Ech0 before 4.4.3 is broken for any authenticated non-admin user, exposing real-time and historical server logs via three unguarded API endpoints. The router registers GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs under middleware that validates JWT signatures but never checks role or scope - a pattern inconsistent with every other admin-restricted route in the codebase. Disclosed log data includes internal file paths, error stack traces, Go module names, and structured application state fields that facilitate reconnaissance for follow-on attacks; no public exploit is identified at time of analysis.

Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count field of any post by repeatedly calling PUT /api/echo/like/:id without credentials or rate limiting. The endpoint is explicitly registered on the public router group, bypassing all JWT authentication middleware, and the service layer performs no identity check or per-user binding before executing the database increment. A proof-of-concept is publicly documented in GHSA advisory GHSA-rgj7-vg8v-j4wr; no active exploitation is confirmed via CISA KEV.

Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the RequireScopes() middleware fall back to role-only checks and honor any valid admin token regardless of declared scope. An admin holding a deliberately narrowed API token - for example one scoped to echo:read - can reach endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export, with the backup handler additionally stripping scope metadata entirely and returning a full database ZIP archive. No CISA KEV listing or confirmed public exploit code has been identified; the vulnerability is fixed in an upstream release (version discrepancy noted below).

Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privilege user to read historical system logs and subscribe to live log streams via GET /api/system/logs, SSE, and WebSocket endpoints. Affected deployments expose operational data including internal file paths, stack traces, admin activity records, background job output, and internal URLs to any valid session holder. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low exploitation complexity and high confidentiality impact make this a meaningful post-authentication information disclosure risk for multi-user deployments.

Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints by sending a valid session token to routes unprotected by the RequireScopes middleware. Affected instances expose system logs, visitor statistics, user email addresses, and live WebSocket log streams to any logged-in user regardless of their assigned role. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and network accessibility make this a realistic threat in any multi-user Ech0 deployment.

Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an attacker who has stolen a 'never-expire' access token retain valid authenticated access indefinitely. Because such tokens carry no JWT 'exp' claim, all three revocation paths fail - logout panics on the nil ExpiresAt field, RevokeToken short-circuits when remaining TTL is zero, and admin 'Delete token' never blacklists the JTI - so a leaked token stays cryptographically valid until the operator rotates the signing key. No public exploit identified at time of analysis; there is no CISA KEV listing and no POC referenced in the provided intelligence.

Stored XSS in Ech0 before 4.7.3 allows admin-privileged attackers to inject executable JavaScript into the public RSS/Atom feed via unescaped tag names or raw HTML markdown content. The payload persists in the database and executes when RSS subscribers open the feed in clients that render Atom `<summary type="html">` as HTML, affecting anonymous and authenticated subscribers without further attacker interaction. No public exploit code and no CISA KEV listing exist at time of analysis; the admin-only injection prerequisite substantially constrains real-world risk.

OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incomplete allowlist enforcement. The `parseAndValidateClientRedirect` function at `internal/service/auth/auth.go:448` compares only scheme and host of the client-supplied `redirect_uri` against the admin allowlist, ignoring path, query, and fragment in violation of RFC 6749 §3.1.2. An attacker who induces a victim to follow a crafted OAuth login link can redirect the post-authentication browser to any path on an allowlisted host, exposing the one-time exchange code via Referer headers or analytics, then redeem it at `POST /api/auth/exchange` for the victim's access and refresh tokens. No public exploit or CISA KEV listing is confirmed at time of analysis; a detailed public advisory (GHSA-p64j-f4x9-wq66) with source code evidence lowers the bar for independent exploitation. Fixed in 4.7.3.

Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.6 by issuing repeated PUT /api/echo/like/:id requests with no authentication, rate limiting, or deduplication. Each request triggers a database write and four-key cache invalidation, enabling both persistent metric corruption and amplified load against the database and cache layers. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing exists at time of analysis.

Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-listing API endpoints, due to a missing `json:"-"` serialization tag on the Comment model's Email field. Any attacker with HTTP access to an Ech0 instance can enumerate every guest commenter email stored in the database by calling `/api/comments` or `/api/comments/public` without credentials. A working proof-of-concept script is published in the GHSA advisory; no public exploit has been confirmed as actively exploited (CISA KEV listing absent).

Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application server to reach internal infrastructure, including cloud provider metadata APIs and Kubernetes service endpoints. The root cause is a missing URL-validation call: `fetchPeerConnectInfo` in `internal/service/connect/connect.go` invokes the unguarded `SendRequest` helper rather than the `SendSafeRequest` variant that enforces `ValidatePublicHTTPURL` private-IP blocking. A working proof-of-concept demonstrating AWS IMDSv1 and Kubernetes API enumeration is publicly available in the GHSA advisory; no active exploitation via CISA KEV has been confirmed, though the CVSS 4.0 score of 8.3 with SC:H reflects elevated impact potential for cloud-hosted deployments.

Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a quadratic-time parsing bypass in the Accept-Language header processing chain. The i18n middleware, active on every HTTP request including unauthenticated public endpoints, forwards the raw header without size filtering to golang.org/x/text/language.ParseAcceptLanguage, where the CVE-2022-32149 mitigation caps '-' separators at 1000 but not '_' separators - which the parser aliases to '-' internally - enabling a single crafted 1 MiB request to consume roughly 1.5 seconds of CPU (~70x amplification). No CISA KEV listing is present and no public exploit code has been independently confirmed, though the GHSA advisory includes end-to-end verification and sufficient technical detail for reproduction.

Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a format trivially crackable via rainbow tables or GPU-accelerated brute force. Versions 5.4.0 and 5.4.1 are confirmed affected; the migration comment in the fix explicitly labels the stored values as 'historical bare MD5' (历史裸 MD5), confirming no per-user salt was applied. Ech0 5.4.2 resolves this by backfilling existing hashes to a dedicated `user_local_auth` table and enabling lazy bcrypt upgrade on next login. No public exploit exists and no active exploitation has been confirmed.