Thinkst Applied Research
Monthly
Denial-of-service in Thinkst Applied Research OpenCanary 0.9.8's MongoDB honeypot module allows unauthenticated remote attackers to trigger an infinite loop (CWE-835) with excessive memory allocation, crashing the OpenCanary process. Only version 0.9.8 is affected, and the MongoDB listener module must be enabled. A proof-of-concept exists per CVSS 4.0 supplemental exploit maturity (E:P); no active exploitation is confirmed in CISA KEV. The impact is confined to availability of the honeypot service itself.
Stored XSS in the AWS API key store component of Thinkst Applied Research Canarytokens allows a low-privileged attacker who knows a token's random identifier to inject persistent malicious scripts that execute in a victim's browser when they view the affected token page. Exploitation is constrained by high attack complexity (AC:H), a prerequisite attack requirement (knowledge of a random identifier), low-privilege authentication, and active user interaction - reflected in an extremely low CVSS 4.0 base score of 1.1. No active exploitation is confirmed; however, the CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists.
HTML injection in Canarytokens' Google Chat webhook notifications allows an attacker who triggers a deployed canarytoken to embed limited HTML content - including crafted hyperlinks - inside the resulting alert message rendered in Google Chat. The vulnerable system is Canarytokens itself (Docker tag sha-4aef1db90 through sha-8ab4dccd), but the integrity impact lands on the subsequent system: the Google Chat interface where defenders receive their alerts. A proof of concept exists per CVSS 4.0 supplemental metric E:P; no confirmed active exploitation or CISA KEV listing exists at time of analysis.
Denial-of-service in Thinkst Applied Research OpenCanary 0.9.8's MongoDB honeypot module allows unauthenticated remote attackers to trigger an infinite loop (CWE-835) with excessive memory allocation, crashing the OpenCanary process. Only version 0.9.8 is affected, and the MongoDB listener module must be enabled. A proof-of-concept exists per CVSS 4.0 supplemental exploit maturity (E:P); no active exploitation is confirmed in CISA KEV. The impact is confined to availability of the honeypot service itself.
Stored XSS in the AWS API key store component of Thinkst Applied Research Canarytokens allows a low-privileged attacker who knows a token's random identifier to inject persistent malicious scripts that execute in a victim's browser when they view the affected token page. Exploitation is constrained by high attack complexity (AC:H), a prerequisite attack requirement (knowledge of a random identifier), low-privilege authentication, and active user interaction - reflected in an extremely low CVSS 4.0 base score of 1.1. No active exploitation is confirmed; however, the CVSS 4.0 vector includes E:P, indicating proof-of-concept exploit code exists.
HTML injection in Canarytokens' Google Chat webhook notifications allows an attacker who triggers a deployed canarytoken to embed limited HTML content - including crafted hyperlinks - inside the resulting alert message rendered in Google Chat. The vulnerable system is Canarytokens itself (Docker tag sha-4aef1db90 through sha-8ab4dccd), but the integrity impact lands on the subsequent system: the Google Chat interface where defenders receive their alerts. A proof of concept exists per CVSS 4.0 supplemental metric E:P; no confirmed active exploitation or CISA KEV listing exists at time of analysis.