Spikster
Monthly
Unauthenticated API access in Spikster (all versions through commit e1cdf8c) lets remote attackers reach roughly 50 backend endpoints because the CipiAuth middleware is registered but never bound to any route group, leaving the entire API open. Attackers can provision and enumerate servers, reset root passwords, read and write arbitrary files on the host, and create database users without any credentials. No public exploit identified at time of analysis, though a public GitHub issue and a VulnCheck advisory document the flaw in detail.
Unauthenticated API access in Spikster (all versions through commit e1cdf8c) lets remote attackers reach roughly 50 backend endpoints because the CipiAuth middleware is registered but never bound to any route group, leaving the entire API open. Attackers can provision and enumerate servers, reset root passwords, read and write arbitrary files on the host, and create database users without any credentials. No public exploit identified at time of analysis, though a public GitHub issue and a VulnCheck advisory document the flaw in detail.