New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

SOCFortress CoPilot: Arbitrary file write via path traversal in ScoutSuite upload

SOCFortress CoPilot before 0.1.77 passes the uploaded filename of the ScoutSuite GCP report route to the file writer without sanitization. An authenticated admin or analyst can use path traversal in the filename to write the uploaded JSON content outside the report directory. The backend runs as root, so host files can be overwritten and operation disrupted; the demonstrated impact does not establish direct code execution, although the advisory is titled RCE. The CNA and NVD rate the CVE 10.0 (CVSS 3.1), while VulDB rates it 9.9.

SOCFortress · CoPilot

ng-antd-admin: Authentication bypass via hardcoded default JWT secret

ng-antd-admin, an Angular and NestJS administration template, ships with a hardcoded default JWT secret. If a deployment does not replace this secret, an attacker can forge valid tokens, including administrator tokens, without any account. This allows bypassing authentication and authorization, accessing protected API endpoints, and taking over accounts, which can lead to data leakage and unauthorized changes. Version 22.0 rejects the default secret in production but still accepts it with a warning in non-production environments.

huajian123 · ng-antd-admin

SOCFortress CoPilot: Unauthenticated access to ScoutSuite reports and GCP key

CoPilot exposes ScoutSuite report files through an unauthenticated static web mount, so anyone who can reach the host can read cloud IAM principals, resource inventories and misconfiguration findings for AWS, Azure and GCP. During a GCP scan, the uploaded service-account key was also written to the same web-served directory and remained readable until the scan finished, which could allow cloud access with the service account's permissions. The attack requires no privileges or user interaction.

SOCFortress · CoPilot

SOCFortress CoPilot: Hardcoded default webhook secret allows unauthenticated access

SOCFortress CoPilot before 0.1.76 ships a publicly known default value for the Graylog and Velociraptor webhook header secrets. If an installation keeps this default, an anonymous attacker can send the known header and bypass JWT authentication on the webhook routes. The attacker can then trigger active-response commands forwarded to the Wazuh manager, which can disrupt endpoints and manipulate defensive controls, and can inject forged alerts for arbitrary customer codes. Deployments with changed header secrets are not affected by this default-secret bypass.

SOCFortress · CoPilot

SOCFortress CoPilot: Stored XSS in alert comments and SOC fields

SOCFortress CoPilot renders user-submitted alert comments and SOC case, asset and health-check fields as raw HTML in the portal. A portal user, including a customer_user, can store script code that runs in the browser of another user who views the affected item, such as an analyst or administrator. According to the CVE description, stolen tokens could enable account takeover and cross-tenant access; this token part is not confirmed by the commit excerpts. The CNA rates the issue CVSS 3.1 9.9 (Critical).

SOCFortress · CoPilot

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

MuseBot: Authentication bypass via hard-coded default session key

MuseBot before 2.0.0 uses the publicly known default session key 'muse_bot_session_key' unless a custom SESSION_KEY is set. An unauthenticated attacker who can reach the admin interface can sign a session cookie with this key and gain full administrative access. From there the attacker can read password hashes, chat records and bot configuration, and stop bots.

yincongcyincong · MuseBot

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.