Hubzilla
Monthly
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Multiple Cross-Site Scripting (XSS) vulnerabilities in Hubzilla 7.0.3 and earlier allows remote attacker to include arbitrary web script or HTML via the rpath parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site request forgery in Hubzilla 11.2.1 and earlier allows a remote unauthenticated attacker to register arbitrary OAuth2 applications under an authenticated victim's account by inducing the victim to visit a malicious page containing an auto-submitting HTML form. The OAuth2 /authorize endpoint handler (Zotlabs\Module\Authorize::post()) performs no CSRF token validation and no Origin or Referer header checks, so a forged cross-origin POST carrying attacker-chosen client_id, client_secret, redirect_uri, and scope parameters is processed silently. The persistence of the rogue OAuth2 registration means the victim's future OAuth2 authorization codes can be intercepted via the attacker-controlled redirect_uri, yielding delegated account access well after the initial attack. No public exploit code or CISA KEV listing has been identified at time of analysis, though a screen recording referenced in the advisory may constitute a functional demonstration.
A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Multiple Cross-Site Scripting (XSS) vulnerabilities in Hubzilla 7.0.3 and earlier allows remote attacker to include arbitrary web script or HTML via the rpath parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.