Psono
Monthly
Server-side request forgery (CWE-918) in Psono Server CE and EE versions 0.1.0 through 7.2.3 allows an authenticated remote user to supply an arbitrary host when configuring a personal Duo MFA device, which the server then passes to the Duo client without a host allowlist or explicit timeout. Because connections still require valid TLS certificates and are confined to HTTPS on port 443, an attacker gains only a failure-mode oracle for internal DNS resolution and service reachability, plus the ability to tie up a server worker against unresponsive targets until the operating-system timeout. No public exploit is identified at time of analysis, EPSS is low at 0.24% (15th percentile), and the risk posture aligns with patching on a normal cycle; the vendor has released 7.2.4 with the fix.
Psono Server CE and EE (versions 3.1.0 through 7.2.3) fail to consume the stored WebAuthn challenge after verifying an assertion, enabling a replay of a captured WebAuthn assertion against separate login token requests as long as that stored challenge remains unchanged. The practical effect is a bypass of the WebAuthn second factor, but only for an attacker who already holds the victim's valid password and has captured one valid assertion; the flaw itself does not disclose plaintext secrets. Severity is moderate (CVSS 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) with a low EPSS of 0.41% (35th percentile); no public exploit code and no confirmed active exploitation are indicated in the available data.
Psono Server (Community and Enterprise editions) 1.0.0 through 7.2.3 fails to enforce the direction of file-transfer credentials, letting an authenticated user who holds only read-only download access to a file-repository object obtain a signed upload URL for an attacker-chosen object key and append data to the owner's file. The result is limited-integrity and limited-availability impact - repository objects can be uploaded over or overwritten and storage consumed - bounded by server-side transfer size, chunk-count and lifetime limits (CVSS 5.4, PR:L, no user interaction). Exploitation requires an existing Psono account, prior read access to the targeted object, and the file-repository feature being in use; no public exploit code was identified at time of analysis, EPSS is low at 0.34% (27th percentile), the issue is not in CISA KEV, and vendor-released patch 7.2.4 is available, which places this in a this-month rather than emergency remediation window.
Psono Server 5.3.5 through 7.2.3 allows an attacker who already holds an authenticated session derived from a scope-restricted API key to escalate privileges by claiming an attacker-controlled device code, receiving in return a full read-write session valid for up to 365 days that outlives and exceeds the original token's scope and lifetime limits. The flaw is a missing write-scope enforcement in the permission class on the device-code claim path (CWE-269), rated CVSS 6.5 with PR:L, and it does not bypass two-factor authentication nor directly disclose plaintext secrets. It is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is low at 0.47% (40th percentile), and the vendor has released a fix in 7.2.4.
Server-side request forgery (CWE-918) in Psono Server CE and EE versions 0.1.0 through 7.2.3 allows an authenticated remote user to supply an arbitrary host when configuring a personal Duo MFA device, which the server then passes to the Duo client without a host allowlist or explicit timeout. Because connections still require valid TLS certificates and are confined to HTTPS on port 443, an attacker gains only a failure-mode oracle for internal DNS resolution and service reachability, plus the ability to tie up a server worker against unresponsive targets until the operating-system timeout. No public exploit is identified at time of analysis, EPSS is low at 0.24% (15th percentile), and the risk posture aligns with patching on a normal cycle; the vendor has released 7.2.4 with the fix.
Psono Server CE and EE (versions 3.1.0 through 7.2.3) fail to consume the stored WebAuthn challenge after verifying an assertion, enabling a replay of a captured WebAuthn assertion against separate login token requests as long as that stored challenge remains unchanged. The practical effect is a bypass of the WebAuthn second factor, but only for an attacker who already holds the victim's valid password and has captured one valid assertion; the flaw itself does not disclose plaintext secrets. Severity is moderate (CVSS 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) with a low EPSS of 0.41% (35th percentile); no public exploit code and no confirmed active exploitation are indicated in the available data.
Psono Server (Community and Enterprise editions) 1.0.0 through 7.2.3 fails to enforce the direction of file-transfer credentials, letting an authenticated user who holds only read-only download access to a file-repository object obtain a signed upload URL for an attacker-chosen object key and append data to the owner's file. The result is limited-integrity and limited-availability impact - repository objects can be uploaded over or overwritten and storage consumed - bounded by server-side transfer size, chunk-count and lifetime limits (CVSS 5.4, PR:L, no user interaction). Exploitation requires an existing Psono account, prior read access to the targeted object, and the file-repository feature being in use; no public exploit code was identified at time of analysis, EPSS is low at 0.34% (27th percentile), the issue is not in CISA KEV, and vendor-released patch 7.2.4 is available, which places this in a this-month rather than emergency remediation window.
Psono Server 5.3.5 through 7.2.3 allows an attacker who already holds an authenticated session derived from a scope-restricted API key to escalate privileges by claiming an attacker-controlled device code, receiving in return a full read-write session valid for up to 365 days that outlives and exceeds the original token's scope and lifetime limits. The flaw is a missing write-scope enforcement in the permission class on the device-code claim path (CWE-269), rated CVSS 6.5 with PR:L, and it does not bypass two-factor authentication nor directly disclose plaintext secrets. It is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; EPSS is low at 0.47% (40th percentile), and the vendor has released a fix in 7.2.4.