Saltcorn
Monthly
SQL injection in Saltcorn's mobile-sync routes lets any authenticated low-privilege user with read access to a single table inject arbitrary SQL via the POST /sync/load_changes and POST /sync/deletes endpoints, enabling full database exfiltration of admin password hashes and configuration secrets and potentially data modification or destruction. It affects Saltcorn releases before 1.4.6, before 1.5.6, and before 1.6.0-beta.5. Publicly available exploit code exists (the GHSA advisory documents a working PoC and SSVC rates exploitation as 'poc'), though EPSS probability is very low at 0.03%.
Path traversal in Saltcorn's mobile sync endpoints enables remote unauthenticated attackers to write arbitrary JSON files and create directories anywhere on the server filesystem, plus read directory listings and JSON file contents. Affects all versions before 1.4.5, 1.5.0-beta.0 through 1.5.4, and 1.6.0-alpha.0 through 1.6.0-beta.3. Publicly available exploit code exists (SSVC: POC status), with EPSS probability of 0.08% (23rd percentile) indicating low widespread exploitation likelihood despite the critical impact. The vulnerability enables direct filesystem manipulation without authentication, though confidentiality impact is rated low (CVSS C:L) as only JSON files and directory listings are readable.
Open redirect in Saltcorn's post-login destination parameter validation allows attackers to redirect authenticated users to attacker-controlled domains via backslash bypass. Versions prior to 1.4.6, 1.5.6, and 1.6.0-beta.5 are vulnerable because the is_relative_url() function only blocks ':/' and '//' but fails to account for WHATWG URL parsing, which normalizes backslashes to forward slashes in special schemes. An attacker can craft a malicious login URL with a dest parameter like /\evil.com/path that bypasses validation, passes through the Location header unencoded, and causes the victim's browser to navigate cross-origin after successful authentication. This requires user interaction (clicking a crafted link) but no special configuration and affects default installations.
SQL injection in Saltcorn's mobile-sync routes lets any authenticated low-privilege user with read access to a single table inject arbitrary SQL via the POST /sync/load_changes and POST /sync/deletes endpoints, enabling full database exfiltration of admin password hashes and configuration secrets and potentially data modification or destruction. It affects Saltcorn releases before 1.4.6, before 1.5.6, and before 1.6.0-beta.5. Publicly available exploit code exists (the GHSA advisory documents a working PoC and SSVC rates exploitation as 'poc'), though EPSS probability is very low at 0.03%.
Path traversal in Saltcorn's mobile sync endpoints enables remote unauthenticated attackers to write arbitrary JSON files and create directories anywhere on the server filesystem, plus read directory listings and JSON file contents. Affects all versions before 1.4.5, 1.5.0-beta.0 through 1.5.4, and 1.6.0-alpha.0 through 1.6.0-beta.3. Publicly available exploit code exists (SSVC: POC status), with EPSS probability of 0.08% (23rd percentile) indicating low widespread exploitation likelihood despite the critical impact. The vulnerability enables direct filesystem manipulation without authentication, though confidentiality impact is rated low (CVSS C:L) as only JSON files and directory listings are readable.
Open redirect in Saltcorn's post-login destination parameter validation allows attackers to redirect authenticated users to attacker-controlled domains via backslash bypass. Versions prior to 1.4.6, 1.5.6, and 1.6.0-beta.5 are vulnerable because the is_relative_url() function only blocks ':/' and '//' but fails to account for WHATWG URL parsing, which normalizes backslashes to forward slashes in special schemes. An attacker can craft a malicious login URL with a dest parameter like /\evil.com/path that bypasses validation, passes through the Location header unencoded, and causes the victim's browser to navigate cross-origin after successful authentication. This requires user interaction (clicking a crafted link) but no special configuration and affects default installations.