Rust Iot Platform
Monthly
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to harvest plaintext credentials for every registered account by querying standard user retrieval and listing API routes. The root cause is CWE-256: the user model persists passwords without hashing, and those fields are then serialized into API responses without sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the triviality of exploitation - a plain HTTP GET to an exposed endpoint - makes CVSS 4.0's 8.7 score a credible reflection of real-world risk for any internet-exposed deployment.
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in the server process by creating a malicious "calc rule". The POST /calc-rule/create endpoint omits the AuthToken guard applied to other routes, and the supplied script field is later passed unsandboxed to quick_js::Context::eval(), giving full script execution once triggered. CVSS is 9.8; no public exploit identified at time of analysis, though the flaw is trivially reachable and the root cause is confirmed by source-level reference.
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the AuthToken request guard simply by sending a non-empty Authorization header such as 'Authorization: fake'. The Rocket request guard in api/src/main.rs checks only for the header's presence and never validates its value against a session, token store, or signature, so unauthenticated attackers gain full access to protected API functionality. No public exploit identified at time of analysis, but the flaw is trivial to trigger and carries a CVSS 9.1.
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to harvest plaintext credentials for every registered account by querying standard user retrieval and listing API routes. The root cause is CWE-256: the user model persists passwords without hashing, and those fields are then serialized into API responses without sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the triviality of exploitation - a plain HTTP GET to an exposed endpoint - makes CVSS 4.0's 8.7 score a credible reflection of real-world risk for any internet-exposed deployment.
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in the server process by creating a malicious "calc rule". The POST /calc-rule/create endpoint omits the AuthToken guard applied to other routes, and the supplied script field is later passed unsandboxed to quick_js::Context::eval(), giving full script execution once triggered. CVSS is 9.8; no public exploit identified at time of analysis, though the flaw is trivially reachable and the root cause is confirmed by source-level reference.
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the AuthToken request guard simply by sending a non-empty Authorization header such as 'Authorization: fake'. The Rocket request guard in api/src/main.rs checks only for the header's presence and never validates its value against a session, token store, or signature, so unauthenticated attackers gain full access to protected API functionality. No public exploit identified at time of analysis, but the flaw is trivial to trigger and carries a CVSS 9.1.