Openboxes
Monthly
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Server-side request forgery in OpenBoxes up to v0.9.7 allows authenticated remote attackers to coerce the application server into issuing HTTP requests to arbitrary internal or external URLs via the unvalidated `params.url` parameter in the Product Upload endpoint. The vulnerable code in `ProductController.groovy` passes the attacker-supplied URL directly to `new URL(params.url).openStream()` with no allowlist, blocklist, or scheme restriction - a textbook CWE-918 implementation flaw. A public proof-of-concept exploit exists on GitHub Gist, and the fix (removing the URL-based upload code path entirely) is available in v0.9.8 and v0.9.8-hotfix1; no CISA KEV listing at time of analysis.
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Server-side request forgery in OpenBoxes up to v0.9.7 allows authenticated remote attackers to coerce the application server into issuing HTTP requests to arbitrary internal or external URLs via the unvalidated `params.url` parameter in the Product Upload endpoint. The vulnerable code in `ProductController.groovy` passes the attacker-supplied URL directly to `new URL(params.url).openStream()` with no allowlist, blocklist, or scheme restriction - a textbook CWE-918 implementation flaw. A public proof-of-concept exploit exists on GitHub Gist, and the fix (removing the URL-based upload code path entirely) is available in v0.9.8 and v0.9.8-hotfix1; no CISA KEV listing at time of analysis.