Oco Server
Monthly
Unauthenticated attackers who know a registered device's serial number can obtain that device's MDM client certificate and private key from OCO-Server's Apple MDM enrollment endpoint and then impersonate the device on all subsequent MDM traffic. The /api-mdm.php/profile handler verifies enrollment plists with openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...), so an arbitrary self-signed certificate satisfies the check and the SERIAL/UDID claims in the payload are trusted without being bound to the signer; the response returns a PKCS#12 bundle containing a certificate with CN=<serial> issued by the server's internal MDM device CA together with its private key, and the victim's mobile_device row is overwritten with the attacker-chosen UDID. Affects OCO-Server 1.2.0 through 1.2.2 (the MDM feature was introduced in 1.2.0); version 1.2.3 fixes the issue. Reported by GitHub_M and rated act_now by vuln.today priority; no public exploit identified at time of analysis, active exploitation is not confirmed, and the reporter states a proof of concept and full reproduction evidence were offered privately under coordinated disclosure.
Stored cross-site scripting in OCO-Server 1.2.0 and earlier lets a crafted agent hostname execute JavaScript inside an administrator's authenticated session when the admin clicks one of the default VNC, RDP, SSH or Ping buttons on the computer details page. Reaching the sink requires three conditions to line up: the non-default 'agent-self-registration-enabled' setting must be turned on, the attacker must hold the shared 'agent-registration-key' used by all enrolled agents, and an administrator must then open the malicious 'ghost' computer's details page and activate a command button (PR:N with UI:R per the assessed vector, so no account is needed but admin interaction is). No CISA KEV entry, no confirmed public exploit code and no EPSS signal are associated with this issue at time of analysis - the GitHub advisory does include a step-by-step reproduction of the escaping bypass, making the flaw straightforward to verify, and the decision label places it in 'this_week' rather than an emergency tier.
An authorization bypass in the OCO-Server Self-Service Portal (all releases prior to 1.2.3 with the feature enabled) lets an authenticated low-privileged portal user queue a software-uninstall job against computers and packages for which their role holds only read visibility and no deploy permission. The uninstall handler's permission-check loop never removes rejected assignment IDs before passing the original list to CoreLogic::uninstall(), and that CoreLogic instance is built with a null SystemUser so every internal checkPermission() call returns true unconditionally - the sibling install path fails closed and is not exploitable. Impact is integrity-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5): a portal account can disrupt installed software on machines belonging to other users or departments by enumerating sequential computer_package.id values, provided it can already read the target resources. No CISA KEV listing or active-exploitation reporting is associated with this CVE, and vulnerability-priority scoring places it in the this_month band; a detailed public PoC reproduction accompanies the upstream advisory; it is not verified as working exploit code.
Unauthenticated attackers who know a registered device's serial number can obtain that device's MDM client certificate and private key from OCO-Server's Apple MDM enrollment endpoint and then impersonate the device on all subsequent MDM traffic. The /api-mdm.php/profile handler verifies enrollment plists with openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...), so an arbitrary self-signed certificate satisfies the check and the SERIAL/UDID claims in the payload are trusted without being bound to the signer; the response returns a PKCS#12 bundle containing a certificate with CN=<serial> issued by the server's internal MDM device CA together with its private key, and the victim's mobile_device row is overwritten with the attacker-chosen UDID. Affects OCO-Server 1.2.0 through 1.2.2 (the MDM feature was introduced in 1.2.0); version 1.2.3 fixes the issue. Reported by GitHub_M and rated act_now by vuln.today priority; no public exploit identified at time of analysis, active exploitation is not confirmed, and the reporter states a proof of concept and full reproduction evidence were offered privately under coordinated disclosure.
Stored cross-site scripting in OCO-Server 1.2.0 and earlier lets a crafted agent hostname execute JavaScript inside an administrator's authenticated session when the admin clicks one of the default VNC, RDP, SSH or Ping buttons on the computer details page. Reaching the sink requires three conditions to line up: the non-default 'agent-self-registration-enabled' setting must be turned on, the attacker must hold the shared 'agent-registration-key' used by all enrolled agents, and an administrator must then open the malicious 'ghost' computer's details page and activate a command button (PR:N with UI:R per the assessed vector, so no account is needed but admin interaction is). No CISA KEV entry, no confirmed public exploit code and no EPSS signal are associated with this issue at time of analysis - the GitHub advisory does include a step-by-step reproduction of the escaping bypass, making the flaw straightforward to verify, and the decision label places it in 'this_week' rather than an emergency tier.
An authorization bypass in the OCO-Server Self-Service Portal (all releases prior to 1.2.3 with the feature enabled) lets an authenticated low-privileged portal user queue a software-uninstall job against computers and packages for which their role holds only read visibility and no deploy permission. The uninstall handler's permission-check loop never removes rejected assignment IDs before passing the original list to CoreLogic::uninstall(), and that CoreLogic instance is built with a null SystemUser so every internal checkPermission() call returns true unconditionally - the sibling install path fails closed and is not exploitable. Impact is integrity-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5): a portal account can disrupt installed software on machines belonging to other users or departments by enumerating sequential computer_package.id values, provided it can already read the target resources. No CISA KEV listing or active-exploitation reporting is associated with this CVE, and vulnerability-priority scoring places it in the this_month band; a detailed public PoC reproduction accompanies the upstream advisory; it is not verified as working exploit code.