Huly Platform
Monthly
Authenticated account takeover in Huly Platform through 0.7.432: the mergeSpecifiedPersons account RPC lacks any authorization or workspace-role check, so any logged-in user - not just a workspace Maintainer - can merge arbitrary person records. An attacker who knows the victim's person UUID and an attacker-controlled person UUID can graft an attacker-owned, unverified but login-capable social id onto the victim person and then complete the takeover through the normal login or password-recovery flow. Vendor patch is available (upstream commit afe11faec1b56f278c0882355a69b08cff1eebd9); no public exploit identified at time of analysis, and real-world risk is bounded by the PR:L prerequisite plus the need to obtain two UUIDs, making instances with open self-service registration the highest-exposure targets.
Server-side request forgery in hcengineering Huly Platform 0.7.382 allows authenticated remote attackers to make arbitrary HTTP requests from the affected server via manipulation of the Import Endpoint in server/front/src/index.ts, potentially enabling access to internal resources, metadata disclosure, or lateral movement within the infrastructure. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts.
JWT token handling in hcengineering Huly Platform 0.7.382 uses hard-coded cryptographic keys in the token.ts component, allowing remote attackers to forge or manipulate authentication tokens with high attack complexity. The vulnerability affects confidentiality and integrity of token-based authentication but requires significant technical effort to exploit, reflected in a low CVSS score (3.7) and high attack complexity rating. No active exploitation has been confirmed, and the vendor has not responded to disclosure attempts.
Authenticated account takeover in Huly Platform through 0.7.432: the mergeSpecifiedPersons account RPC lacks any authorization or workspace-role check, so any logged-in user - not just a workspace Maintainer - can merge arbitrary person records. An attacker who knows the victim's person UUID and an attacker-controlled person UUID can graft an attacker-owned, unverified but login-capable social id onto the victim person and then complete the takeover through the normal login or password-recovery flow. Vendor patch is available (upstream commit afe11faec1b56f278c0882355a69b08cff1eebd9); no public exploit identified at time of analysis, and real-world risk is bounded by the PR:L prerequisite plus the need to obtain two UUIDs, making instances with open self-service registration the highest-exposure targets.
Server-side request forgery in hcengineering Huly Platform 0.7.382 allows authenticated remote attackers to make arbitrary HTTP requests from the affected server via manipulation of the Import Endpoint in server/front/src/index.ts, potentially enabling access to internal resources, metadata disclosure, or lateral movement within the infrastructure. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts.
JWT token handling in hcengineering Huly Platform 0.7.382 uses hard-coded cryptographic keys in the token.ts component, allowing remote attackers to forge or manipulate authentication tokens with high attack complexity. The vulnerability affects confidentiality and integrity of token-based authentication but requires significant technical effort to exploit, reflected in a low CVSS score (3.7) and high attack complexity rating. No active exploitation has been confirmed, and the vendor has not responded to disclosure attempts.