Tarsweb
Monthly
Complete authentication bypass in TarsWeb (the web console for the TARS microservice framework) through 3.0.14 lets a remote unauthenticated attacker act as any account, including an administrator, by sending a forged X-Forwarded-For header naming the loopback address together with a uid query parameter. Because app.js trusts Koa's proxy option blindly and the SSO middleware treats the loopback allowlist match as authorization to adopt the caller-supplied uid, no ticket, cookie, or password is ever checked. No public exploit is identified at the time of analysis, but the technique is trivial and the CVSS 4.0 base score is 9.3 (Critical).
Missing authorization checks across four methods in TarsWeb's PatchController allow any authenticated account - regardless of its assigned application scope - to deploy arbitrary packages to any server managed by the console, retrieve or delete packages belonging to other applications, and alter default deployment configurations system-wide. Affected versions span TarsWeb through at least v3.0.16 as confirmed by the vulnerable source reference at that tag. No public exploit code has been identified at time of analysis, but the vulnerability is straightforwardly exploitable by any user with a valid TarsWeb account, making it a high-priority internal threat in multi-tenant or shared TarsWeb installations.
Complete authentication bypass in TarsWeb (the web console for the TARS microservice framework) through 3.0.14 lets a remote unauthenticated attacker act as any account, including an administrator, by sending a forged X-Forwarded-For header naming the loopback address together with a uid query parameter. Because app.js trusts Koa's proxy option blindly and the SSO middleware treats the loopback allowlist match as authorization to adopt the caller-supplied uid, no ticket, cookie, or password is ever checked. No public exploit is identified at the time of analysis, but the technique is trivial and the CVSS 4.0 base score is 9.3 (Critical).
Missing authorization checks across four methods in TarsWeb's PatchController allow any authenticated account - regardless of its assigned application scope - to deploy arbitrary packages to any server managed by the console, retrieve or delete packages belonging to other applications, and alter default deployment configurations system-wide. Affected versions span TarsWeb through at least v3.0.16 as confirmed by the vulnerable source reference at that tag. No public exploit code has been identified at time of analysis, but the vulnerability is straightforwardly exploitable by any user with a valid TarsWeb account, making it a high-priority internal threat in multi-tenant or shared TarsWeb installations.