Pipeshub Ai
Monthly
PipesHub 0.3.0 through 0.9.1 allows an authenticated user holding only the crawl:write OAuth scope to permanently destroy a connector instance and purge its graph records and embeddings by sending a crafted :connector path segment to the crawling manager schedule route. A value such as web.delete is concatenated into the published event type (web.delete.resync), which the Python connector service splits on the dot and dispatches to its delete handler, bypassing both the connector:delete scope check and the connector-lock guard enforced by the sanctioned DELETE /api/v1/connectors/:id endpoint. The privilege escalation is bounded to connectors the caller can already pass validateConnectorAccess for (their own personal connector, or an org admin's team connector); the vendor fixed the flaw in 0.10.0 by deriving the event action from the stored connector instance, and the advisory includes a verified, executed proof-of-concept walkthrough. The vulnerability is not listed in CISA KEV, and no EPSS score was supplied.
Server-side request forgery in PipesHub's document indexing pipeline lets anyone who can place content in front of the indexer make the server issue HTTP GETs to addresses of their choosing. Image URLs embedded in the body of an uploaded Markdown or HTML file, an email delivered to a connector-synced mailbox, or a page pulled in by the web/RSS connector are checked only for scheme and image file extension before ImageParser._fetch_single_url calls aiohttp with allow_redirects=True, so loopback, private-network and cloud instance-metadata targets are reachable despite the blocked-host policy the same codebase applies to other user-supplied fetches. The documented proof-of-concept in the public advisory confirms the service's own aiohttp client fetching a loopback URL that existed only inside an uploaded file; reading the response back into persisted indexed content was inferred from code rather than demonstrated, because the test host had no model provider configured. Exploitation status is not confirmed actively exploited (no CISA KEV listing) and no independently verified exploit tooling has been published, though the advisory's executed walkthrough gives attackers a clear template; the vendor fix is PipesHub 0.10.0, and priority is a this-month remediation cadence rather than a drop-everything emergency.
Rate limiting in PipesHub 0.1.0 through 0.9.1 can be evaded entirely by any unauthenticated remote client, because the limiter derives its bucket key from the client-supplied X-Forwarded-For or X-Real-IP header rather than the real socket address. Rotating that header on each request yields a fresh counter every time, so the global limiter that is the only protection on /authenticate, /login/otp/generate and /password/forgot never engages, enabling password spraying, OTP guessing and password-reset email flooding against arbitrary addresses. The bypass itself only removes throttling, with integrity-only impact (CVSS 3.1 C:N/I:L/A:N); conversion into account takeover still depends on guessing a valid password or six-digit OTP, and email-bombing impact depends on the reset endpoint accepting arbitrary addresses. Fixed in 0.10.0; the vendor advisory includes an executed proof of concept showing 0 of 90 header-rotating requests throttled, and no confirmed active exploitation (CISA KEV) has been reported.
PipesHub 0.3.0 through 0.9.1 allows an authenticated user holding only the crawl:write OAuth scope to permanently destroy a connector instance and purge its graph records and embeddings by sending a crafted :connector path segment to the crawling manager schedule route. A value such as web.delete is concatenated into the published event type (web.delete.resync), which the Python connector service splits on the dot and dispatches to its delete handler, bypassing both the connector:delete scope check and the connector-lock guard enforced by the sanctioned DELETE /api/v1/connectors/:id endpoint. The privilege escalation is bounded to connectors the caller can already pass validateConnectorAccess for (their own personal connector, or an org admin's team connector); the vendor fixed the flaw in 0.10.0 by deriving the event action from the stored connector instance, and the advisory includes a verified, executed proof-of-concept walkthrough. The vulnerability is not listed in CISA KEV, and no EPSS score was supplied.
Server-side request forgery in PipesHub's document indexing pipeline lets anyone who can place content in front of the indexer make the server issue HTTP GETs to addresses of their choosing. Image URLs embedded in the body of an uploaded Markdown or HTML file, an email delivered to a connector-synced mailbox, or a page pulled in by the web/RSS connector are checked only for scheme and image file extension before ImageParser._fetch_single_url calls aiohttp with allow_redirects=True, so loopback, private-network and cloud instance-metadata targets are reachable despite the blocked-host policy the same codebase applies to other user-supplied fetches. The documented proof-of-concept in the public advisory confirms the service's own aiohttp client fetching a loopback URL that existed only inside an uploaded file; reading the response back into persisted indexed content was inferred from code rather than demonstrated, because the test host had no model provider configured. Exploitation status is not confirmed actively exploited (no CISA KEV listing) and no independently verified exploit tooling has been published, though the advisory's executed walkthrough gives attackers a clear template; the vendor fix is PipesHub 0.10.0, and priority is a this-month remediation cadence rather than a drop-everything emergency.
Rate limiting in PipesHub 0.1.0 through 0.9.1 can be evaded entirely by any unauthenticated remote client, because the limiter derives its bucket key from the client-supplied X-Forwarded-For or X-Real-IP header rather than the real socket address. Rotating that header on each request yields a fresh counter every time, so the global limiter that is the only protection on /authenticate, /login/otp/generate and /password/forgot never engages, enabling password spraying, OTP guessing and password-reset email flooding against arbitrary addresses. The bypass itself only removes throttling, with integrity-only impact (CVSS 3.1 C:N/I:L/A:N); conversion into account takeover still depends on guessing a valid password or six-digit OTP, and email-bombing impact depends on the reset endpoint accepting arbitrary addresses. Fixed in 0.10.0; the vendor advisory includes an executed proof of concept showing 0 of 90 header-rotating requests throttled, and no confirmed active exploitation (CISA KEV) has been reported.