Station Middleware
Monthly
EnergizeLab's station-middleware (a NestJS-based service distributed as Docker images 1.6.5 through 1.8.2) exposes administrative APIs that perform no role or authorization checks, so any authenticated user holding a valid low-privilege account can read AI provider API keys and modify configuration and object-store contents. Tracked as CWE-862 and rated 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) because the flaw lets a low-privileged principal cross a security boundary to reach high-confidentiality and high-integrity resources; no availability impact is described. Exploitation requires pre-existing valid credentials plus network reachability to the middleware API - there is no pre-authentication path - and no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS data was supplied.
Arbitrary file read in EnergizeLab station-middleware Docker images 1.6.5 through 1.8.2 lets any registered low-privilege account supply a request parameter that the backend treats as a file path, resolving it without adequate restriction and returning files from outside the intended directories, which can expose middleware source, configuration and server secrets. Exploitation is remote and authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N in our independent assessment) and is confined to the listed Docker image versions; the CNA-published score of 9.9 (with scope change plus high integrity and availability impact) conflicts with our read-only impact assessment and should be reconciled before treating this as a top-tier emergency. No CISA KEV entry is present in the supplied data and no public exploit was identified at time of analysis, although the reference set includes a GitHub repository link that may contain a demonstration. Exposure risk is highest where container images carry secrets, tokens, or private keys on a filesystem reachable by the middleware process.
EnergizeLab's station-middleware (a NestJS-based service distributed as Docker images 1.6.5 through 1.8.2) exposes administrative APIs that perform no role or authorization checks, so any authenticated user holding a valid low-privilege account can read AI provider API keys and modify configuration and object-store contents. Tracked as CWE-862 and rated 9.6 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) because the flaw lets a low-privileged principal cross a security boundary to reach high-confidentiality and high-integrity resources; no availability impact is described. Exploitation requires pre-existing valid credentials plus network reachability to the middleware API - there is no pre-authentication path - and no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS data was supplied.
Arbitrary file read in EnergizeLab station-middleware Docker images 1.6.5 through 1.8.2 lets any registered low-privilege account supply a request parameter that the backend treats as a file path, resolving it without adequate restriction and returning files from outside the intended directories, which can expose middleware source, configuration and server secrets. Exploitation is remote and authenticated (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N in our independent assessment) and is confined to the listed Docker image versions; the CNA-published score of 9.9 (with scope change plus high integrity and availability impact) conflicts with our read-only impact assessment and should be reconciled before treating this as a top-tier emergency. No CISA KEV entry is present in the supplied data and no public exploit was identified at time of analysis, although the reference set includes a GitHub repository link that may contain a demonstration. Exposure risk is highest where container images carry secrets, tokens, or private keys on a filesystem reachable by the middleware process.