Hcengineering
Monthly
Authenticated account takeover in Huly Platform through 0.7.432: the mergeSpecifiedPersons account RPC lacks any authorization or workspace-role check, so any logged-in user - not just a workspace Maintainer - can merge arbitrary person records. An attacker who knows the victim's person UUID and an attacker-controlled person UUID can graft an attacker-owned, unverified but login-capable social id onto the victim person and then complete the takeover through the normal login or password-recovery flow. Vendor patch is available (upstream commit afe11faec1b56f278c0882355a69b08cff1eebd9); no public exploit identified at time of analysis, and real-world risk is bounded by the PR:L prerequisite plus the need to obtain two UUIDs, making instances with open self-service registration the highest-exposure targets.
Server-side request forgery in the Huly Platform print service (pod-print) through version 0.7.426 lets an authenticated workspace member hand an arbitrary URL to the print endpoint, which Puppeteer fetches and renders back as a downloadable PDF or image. Because no hostname allowlist is enforced, the headless browser can be steered at internal metadata services (e.g. cloud IMDS endpoints) and other network-internal hosts, turning the platform into an internal network proxy and credential-leak vector. No CISA KEV listing and no publicly available exploit code were identified at time of analysis, and CISA SSVC records exploitation as 'none' with automatable 'no'.
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front pod into making arbitrary HTTP requests to internal infrastructure. Any valid workspace account can supply attacker-controlled URLs; the server fetches them, leaking internal service responses - including cloud metadata credentials - back to the attacker. A publicly available exploit exists per the GitHub issue tracker, though active exploitation has not been confirmed by CISA KEV. The CVSS 4.0 vector assigns SC:H, flagging high confidentiality impact on subsequent (internal) systems as the primary risk.
Server-side request forgery in hcengineering Huly Platform 0.7.382 allows authenticated remote attackers to make arbitrary HTTP requests from the affected server via manipulation of the Import Endpoint in server/front/src/index.ts, potentially enabling access to internal resources, metadata disclosure, or lateral movement within the infrastructure. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts.
JWT token handling in hcengineering Huly Platform 0.7.382 uses hard-coded cryptographic keys in the token.ts component, allowing remote attackers to forge or manipulate authentication tokens with high attack complexity. The vulnerability affects confidentiality and integrity of token-based authentication but requires significant technical effort to exploit, reflected in a low CVSS score (3.7) and high attack complexity rating. No active exploitation has been confirmed, and the vendor has not responded to disclosure attempts.
Authenticated account takeover in Huly Platform through 0.7.432: the mergeSpecifiedPersons account RPC lacks any authorization or workspace-role check, so any logged-in user - not just a workspace Maintainer - can merge arbitrary person records. An attacker who knows the victim's person UUID and an attacker-controlled person UUID can graft an attacker-owned, unverified but login-capable social id onto the victim person and then complete the takeover through the normal login or password-recovery flow. Vendor patch is available (upstream commit afe11faec1b56f278c0882355a69b08cff1eebd9); no public exploit identified at time of analysis, and real-world risk is bounded by the PR:L prerequisite plus the need to obtain two UUIDs, making instances with open self-service registration the highest-exposure targets.
Server-side request forgery in the Huly Platform print service (pod-print) through version 0.7.426 lets an authenticated workspace member hand an arbitrary URL to the print endpoint, which Puppeteer fetches and renders back as a downloadable PDF or image. Because no hostname allowlist is enforced, the headless browser can be steered at internal metadata services (e.g. cloud IMDS endpoints) and other network-internal hosts, turning the platform into an internal network proxy and credential-leak vector. No CISA KEV listing and no publicly available exploit code were identified at time of analysis, and CISA SSVC records exploitation as 'none' with automatable 'no'.
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front pod into making arbitrary HTTP requests to internal infrastructure. Any valid workspace account can supply attacker-controlled URLs; the server fetches them, leaking internal service responses - including cloud metadata credentials - back to the attacker. A publicly available exploit exists per the GitHub issue tracker, though active exploitation has not been confirmed by CISA KEV. The CVSS 4.0 vector assigns SC:H, flagging high confidentiality impact on subsequent (internal) systems as the primary risk.
Server-side request forgery in hcengineering Huly Platform 0.7.382 allows authenticated remote attackers to make arbitrary HTTP requests from the affected server via manipulation of the Import Endpoint in server/front/src/index.ts, potentially enabling access to internal resources, metadata disclosure, or lateral movement within the infrastructure. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts.
JWT token handling in hcengineering Huly Platform 0.7.382 uses hard-coded cryptographic keys in the token.ts component, allowing remote attackers to forge or manipulate authentication tokens with high attack complexity. The vulnerability affects confidentiality and integrity of token-based authentication but requires significant technical effort to exploit, reflected in a low CVSS score (3.7) and high attack complexity rating. No active exploitation has been confirmed, and the vendor has not responded to disclosure attempts.