Turms
Monthly
Cross-site request forgery in Turms Admin API through v0.10.0-SNAPSHOT allows remote attackers to cause an authenticated administrator's browser to issue unintended administrative requests, permitting privileged actions to be performed on the victim's behalf. Exploitation requires the victim admin to have a live session and to be socially engineered into visiting an attacker-controlled page or clicking a crafted link (UI:R); the attacker needs no credentials of their own (PR:N). Publicly available exploit code exists, the vendor/NVD CVSS 3.1 base is 6.1, and the independent assessment raises the integrity impact to High (C:L/I:H/A:N) while keeping the same network, no-privilege, user-interaction, and scope-change characteristics.
Authenticated users on Turms IM Server v0.10.0-SNAPSHOT and earlier can exploit a broken access control flaw (CWE-284) in the handleQueryUserOnlineStatusesRequest() method to query arbitrary users' online status, device information, and login timestamps without proper authorization checks. The vulnerability requires a valid account (CVSS PR:L) and is remotely exploitable, with publicly available exploit code. The independent assessment rates it medium severity because it leaks presence metadata rather than message content or credentials.
Turms Server (turms-im:turms) v0.10.0-SNAPSHOT and earlier retains administrator passwords in cleartext in the rawPassword field of AdminInfo objects cached by BaseAdminService, so a locally positioned attacker who can read the JVM process memory - via memory dump, heap analysis, or debugger attachment - can recover admin credentials and completely bypass the intended bcrypt protection. Per our independent assessment the vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation requires an existing high-privilege local foothold on the host, victims need not interact, and only the credentials of administrators who have authenticated since the server process started are exposed. Publicly available exploit code exists, but no CISA KEV listing or other confirmation of active exploitation was identified at time of analysis.
Memory exhaustion denial of service in Turms AI-Serving (v0.10.0-SNAPSHOT and earlier) allows remote attackers to crash the service by uploading specially crafted compressed images that expand to gigabytes when loaded via OpenCV's imread() without dimension validation. The vulnerability is in the ExtendedOpenCVImage class, and publicly available exploit code exists. The risk is bounded to deployments that expose the OCR/image upload feature, and no authentication is required if that service is publicly accessible.
Improper file type validation in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) allows unauthenticated remote attackers to upload arbitrary files - executables, scripts, HTML documents, or web shells - to the OCR image-upload endpoint, because the OcrController's @FormData(contentType = MediaTypeConst.IMAGE) restriction validates only client-supplied Content-Type headers and file extensions rather than actual file content. Publicly available exploit code exists in the form of a published PoC report, and the issue carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N per NVD; our assessment adds a low integrity impact). The elevated outcomes sometimes attributed to this flaw - server-side code execution or stored XSS - are not guaranteed by the upload itself and only materialize if the deployment executes the upload directory or serves stored files back to users; a hardening-lacking deployment that does neither faces only arbitrary file storage.
Cross-site request forgery in Turms Admin API through v0.10.0-SNAPSHOT allows remote attackers to cause an authenticated administrator's browser to issue unintended administrative requests, permitting privileged actions to be performed on the victim's behalf. Exploitation requires the victim admin to have a live session and to be socially engineered into visiting an attacker-controlled page or clicking a crafted link (UI:R); the attacker needs no credentials of their own (PR:N). Publicly available exploit code exists, the vendor/NVD CVSS 3.1 base is 6.1, and the independent assessment raises the integrity impact to High (C:L/I:H/A:N) while keeping the same network, no-privilege, user-interaction, and scope-change characteristics.
Authenticated users on Turms IM Server v0.10.0-SNAPSHOT and earlier can exploit a broken access control flaw (CWE-284) in the handleQueryUserOnlineStatusesRequest() method to query arbitrary users' online status, device information, and login timestamps without proper authorization checks. The vulnerability requires a valid account (CVSS PR:L) and is remotely exploitable, with publicly available exploit code. The independent assessment rates it medium severity because it leaks presence metadata rather than message content or credentials.
Turms Server (turms-im:turms) v0.10.0-SNAPSHOT and earlier retains administrator passwords in cleartext in the rawPassword field of AdminInfo objects cached by BaseAdminService, so a locally positioned attacker who can read the JVM process memory - via memory dump, heap analysis, or debugger attachment - can recover admin credentials and completely bypass the intended bcrypt protection. Per our independent assessment the vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation requires an existing high-privilege local foothold on the host, victims need not interact, and only the credentials of administrators who have authenticated since the server process started are exposed. Publicly available exploit code exists, but no CISA KEV listing or other confirmation of active exploitation was identified at time of analysis.
Memory exhaustion denial of service in Turms AI-Serving (v0.10.0-SNAPSHOT and earlier) allows remote attackers to crash the service by uploading specially crafted compressed images that expand to gigabytes when loaded via OpenCV's imread() without dimension validation. The vulnerability is in the ExtendedOpenCVImage class, and publicly available exploit code exists. The risk is bounded to deployments that expose the OCR/image upload feature, and no authentication is required if that service is publicly accessible.
Improper file type validation in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) allows unauthenticated remote attackers to upload arbitrary files - executables, scripts, HTML documents, or web shells - to the OCR image-upload endpoint, because the OcrController's @FormData(contentType = MediaTypeConst.IMAGE) restriction validates only client-supplied Content-Type headers and file extensions rather than actual file content. Publicly available exploit code exists in the form of a published PoC report, and the issue carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N per NVD; our assessment adds a low integrity impact). The elevated outcomes sometimes attributed to this flaw - server-side code execution or stored XSS - are not guaranteed by the upload itself and only materialize if the deployment executes the upload directory or serves stored files back to users; a hardening-lacking deployment that does neither faces only arbitrary file storage.