Ransomlook
Monthly
Sensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of the authenticated /admin/apikeys page: although the UI only shows a truncated key, each token is embedded verbatim in hidden form fields backing the enable/disable, private-access, and delete actions. Anyone able to view the admin page source or DOM, or any intermediary that retains HTTP response bodies (debugging proxies, browser caches, monitoring systems), can recover the complete tokens and then authenticate with those keys' privileges, including access to private data. There is no public exploit identified at time of analysis; the issue is fixed upstream by replacing rendered tokens with SHA-256-derived opaque handles.
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to enumerate valid usernames via response-time differences, conduct unlimited brute-force or credential-stuffing attacks against discovered accounts, and exhaust the application's synchronous Gunicorn worker pool through a sustained login flood causing application-wide denial of service. All versions matching cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* are affected prior to the upstream fix commit. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.8 is driven by the combination of confidentiality leakage (username enumeration) and high availability impact (worker exhaustion).
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the security context of any user who clicks the CSV export button on an affected wallet record. The root cause is insertion of externally-sourced wallet addresses and blockchain names directly into an inline JavaScript onclick handler, where Jinja2's HTML autoescaping is bypassed because the browser's HTML parser decodes entities such as ' back to quote characters before the JavaScript engine processes the attribute value. Because RansomLook ingests data from the public crowd-sourced ransomwhe.re feed without prior validation, exploitation may not require an authenticated RansomLook account - an attacker who can introduce a crafted wallet record into that upstream feed can reach the vulnerable rendering path. No public exploit code or active exploitation has been identified at time of analysis; a patch is available via a confirmed vendor commit.
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated low-privileged user modify the application's config/generic.json, tampering with notification, LDAP, SMTP, and general settings. Because the endpoint enforces only that a session exists - with no administrator/privilege check (CWE-862) - a compromised or intentionally low-tier account can redirect integrations, alter authentication-related settings, or knock the installation offline. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; the vendor CVSS 4.0 base score is 9.4.
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API endpoints. Location records associated with monitored ransomware groups and markets were returned verbatim - including the `header` field containing authentication tokens and session cookies, the `init_script` field holding CAPTCHA and anti-bot bypass logic, and `browser` metadata revealing the scraping environment - whenever a location was not explicitly marked private. The patch, confirmed via GitHub commit cc9182930306ff36c7b3424817d49f18df3c85d1, introduces a strict field allowlist and a sanitization function applied across all three affected API routes; no public exploit or KEV listing has been identified at time of analysis.
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side request forgery by embedding crafted resource references in analysis documents. Prior to the patch, WeasyPrint's default URL fetcher resolved any scheme - including file:// and http:// - using the privileges and network access of the RansomLook server process, enabling exfiltration of local configuration and credentials or enumeration of internal network services. No public exploit code or CISA KEV listing exists at time of analysis; a fix is confirmed via GitHub commit 34dc0285583dae483b4d48c8e98fff942b755f5f, which introduces a strict URL allowlist restricting rendering to data: URIs, the report logo, and analysis asset files.
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to exfiltrate arbitrary files readable by the RansomLook process, including configuration secrets and API credentials. The screen field stored in the database is concatenated directly with the application's source/ directory path without boundary validation, enabling traversal sequences such as ../config/generic.json to escape the intended directory. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the federation import mechanism means a compromised upstream instance can poison a victim's database without holding any account on the victim system.
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets through public notification channels (Rocket.Chat, Mastodon, Bluesky, email) and the public MISP feed, due to incomplete privacy enforcement at the entity level rather than the post level. The post-processing logic in posts.py checked only the individual post's private flag, leaving freshly parsed victims of private groups and markets unprotected because new posts arrive with private=False. A parallel defect in misp_feed.py restricted its privacy check to the group database only, so victims of private markets were admitted to the public MISP feed. No public exploit is identified at time of analysis; this is a passive information-disclosure flaw - subscribers to the affected channels receive the leaked data automatically without taking any active exploitation step.
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remote attackers read data explicitly marked private. Several web views and API endpoints (notably /compare, ransom-note views, and search) failed to filter entities flagged as private, exposing private group and market names, ransom-note content, and metadata such as post counts, mirror totals, and uptime. Rated CVSS 4.0 9.2 (critical); a vendor patch exists (commit dc92d6d) and no public exploit has been identified at time of analysis.
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any remote user who can reach the web application to pull records marked private. The legacy /export/<database> route exports selected internal databases without authentication and does not consistently apply the app's private-entity access restrictions, so private groups, markets, and posts can leak. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/group/new endpoint, which lacked Flask-Login's login_required decorator that guards other admin routes. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-complexity exploitation requiring no credentials or user interaction. No public exploit identified at time of analysis and no CISA KEV listing, but the trivially low barrier - any attacker who can reach the web interface qualifies - elevates practical risk for publicly exposed instances, with high availability impact (VA:H) suggesting unbounded entry injection could degrade application usability.
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to enumerate health data for all tracked groups and markets - including those flagged as private - by supplying glob metacharacters to the /api/health/<name> and /api/crypto/chain/<chain> endpoints. The vulnerability stems from unsanitized caller-supplied values being interpolated directly into Redis SCAN MATCH patterns, expanding scan scope beyond the intended target entity. No public exploit has been identified at time of analysis; a vendor-released fix is available via an upstream GitHub commit that introduces centralized glob escaping across all affected code paths.
RansomLook versions prior to 1.9.0 disclose non-public location information through an improper list-filtering logic error in the API layer. The vulnerability stems from removing elements from a list during iteration in website/web/api/genericapi.py, causing entries marked as private to persist in API responses. Unauthenticated remote attackers can retrieve sensitive location data that should remain hidden, with CVSS 6.9 indicating low confidentiality impact across the network.
Sensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of the authenticated /admin/apikeys page: although the UI only shows a truncated key, each token is embedded verbatim in hidden form fields backing the enable/disable, private-access, and delete actions. Anyone able to view the admin page source or DOM, or any intermediary that retains HTTP response bodies (debugging proxies, browser caches, monitoring systems), can recover the complete tokens and then authenticate with those keys' privileges, including access to private data. There is no public exploit identified at time of analysis; the issue is fixed upstream by replacing rendered tokens with SHA-256-derived opaque handles.
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read access to the application home directory, enabling complete authentication bypass. The secret key governs Flask session cookie signing and the legacy API-key derivation function; possession of it allows an attacker to forge valid session cookies and impersonate any user, including administrators. In LDAP-configured deployments, exploitation is especially direct because the session user loader accepts arbitrary usernames without verifying their existence against any user store. No public exploit has been identified at time of analysis.
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to enumerate valid usernames via response-time differences, conduct unlimited brute-force or credential-stuffing attacks against discovered accounts, and exhaust the application's synchronous Gunicorn worker pool through a sustained login flood causing application-wide denial of service. All versions matching cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* are affected prior to the upstream fix commit. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.8 is driven by the combination of confidentiality leakage (username enumeration) and high availability impact (worker exhaustion).
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the security context of any user who clicks the CSV export button on an affected wallet record. The root cause is insertion of externally-sourced wallet addresses and blockchain names directly into an inline JavaScript onclick handler, where Jinja2's HTML autoescaping is bypassed because the browser's HTML parser decodes entities such as ' back to quote characters before the JavaScript engine processes the attribute value. Because RansomLook ingests data from the public crowd-sourced ransomwhe.re feed without prior validation, exploitation may not require an authenticated RansomLook account - an attacker who can introduce a crafted wallet record into that upstream feed can reach the vulnerable rendering path. No public exploit code or active exploitation has been identified at time of analysis; a patch is available via a confirmed vendor commit.
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated low-privileged user modify the application's config/generic.json, tampering with notification, LDAP, SMTP, and general settings. Because the endpoint enforces only that a session exists - with no administrator/privilege check (CWE-862) - a compromised or intentionally low-tier account can redirect integrations, alter authentication-related settings, or knock the installation offline. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; the vendor CVSS 4.0 base score is 9.4.
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API endpoints. Location records associated with monitored ransomware groups and markets were returned verbatim - including the `header` field containing authentication tokens and session cookies, the `init_script` field holding CAPTCHA and anti-bot bypass logic, and `browser` metadata revealing the scraping environment - whenever a location was not explicitly marked private. The patch, confirmed via GitHub commit cc9182930306ff36c7b3424817d49f18df3c85d1, introduces a strict field allowlist and a sanitization function applied across all three affected API routes; no public exploit or KEV listing has been identified at time of analysis.
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side request forgery by embedding crafted resource references in analysis documents. Prior to the patch, WeasyPrint's default URL fetcher resolved any scheme - including file:// and http:// - using the privileges and network access of the RansomLook server process, enabling exfiltration of local configuration and credentials or enumeration of internal network services. No public exploit code or CISA KEV listing exists at time of analysis; a fix is confirmed via GitHub commit 34dc0285583dae483b4d48c8e98fff942b755f5f, which introduces a strict URL allowlist restricting rendering to data: URIs, the report logo, and analysis asset files.
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to exfiltrate arbitrary files readable by the RansomLook process, including configuration secrets and API credentials. The screen field stored in the database is concatenated directly with the application's source/ directory path without boundary validation, enabling traversal sequences such as ../config/generic.json to escape the intended directory. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the federation import mechanism means a compromised upstream instance can poison a victim's database without holding any account on the victim system.
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets through public notification channels (Rocket.Chat, Mastodon, Bluesky, email) and the public MISP feed, due to incomplete privacy enforcement at the entity level rather than the post level. The post-processing logic in posts.py checked only the individual post's private flag, leaving freshly parsed victims of private groups and markets unprotected because new posts arrive with private=False. A parallel defect in misp_feed.py restricted its privacy check to the group database only, so victims of private markets were admitted to the public MISP feed. No public exploit is identified at time of analysis; this is a passive information-disclosure flaw - subscribers to the affected channels receive the leaked data automatically without taking any active exploitation step.
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remote attackers read data explicitly marked private. Several web views and API endpoints (notably /compare, ransom-note views, and search) failed to filter entities flagged as private, exposing private group and market names, ransom-note content, and metadata such as post counts, mirror totals, and uptime. Rated CVSS 4.0 9.2 (critical); a vendor patch exists (commit dc92d6d) and no public exploit has been identified at time of analysis.
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any remote user who can reach the web application to pull records marked private. The legacy /export/<database> route exports selected internal databases without authentication and does not consistently apply the app's private-entity access restrictions, so private groups, markets, and posts can leak. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/group/new endpoint, which lacked Flask-Login's login_required decorator that guards other admin routes. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, zero-complexity exploitation requiring no credentials or user interaction. No public exploit identified at time of analysis and no CISA KEV listing, but the trivially low barrier - any attacker who can reach the web interface qualifies - elevates practical risk for publicly exposed instances, with high availability impact (VA:H) suggesting unbounded entry injection could degrade application usability.
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to enumerate health data for all tracked groups and markets - including those flagged as private - by supplying glob metacharacters to the /api/health/<name> and /api/crypto/chain/<chain> endpoints. The vulnerability stems from unsanitized caller-supplied values being interpolated directly into Redis SCAN MATCH patterns, expanding scan scope beyond the intended target entity. No public exploit has been identified at time of analysis; a vendor-released fix is available via an upstream GitHub commit that introduces centralized glob escaping across all affected code paths.
RansomLook versions prior to 1.9.0 disclose non-public location information through an improper list-filtering logic error in the API layer. The vulnerability stems from removing elements from a list during iteration in website/web/api/genericapi.py, causing entries marked as private to persist in API responses. Unauthenticated remote attackers can retrieve sensitive location data that should remain hidden, with CVSS 6.9 indicating low confidentiality impact across the network.