Common Weakness Enumeration

CWE-306

Allowed

Missing Authentication for Critical Function

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

4625 vulnerabilities reference this CWE, most recent first.

GHSA-9CPH-W8MV-Q56R

Vulnerability from github – Published: 2026-09-04 18:31 – Updated: 2026-09-04 18:31
VLAI
Details

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-9317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-04T18:18:07Z",
    "severity": "CRITICAL"
  },
  "details": "Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.",
  "id": "GHSA-9cph-w8mv-q56r",
  "modified": "2026-09-04T18:31:35Z",
  "published": "2026-09-04T18:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NangoHQ/nango/pull/7288"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NangoHQ/nango/releases/tag/v0.71.6"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9CQP-HGPJ-49WR

Vulnerability from github – Published: 2026-06-19 00:31 – Updated: 2026-06-19 00:31
VLAI
Details

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-54130"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-18T22:16:32Z",
    "severity": "CRITICAL"
  },
  "details": "Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.",
  "id": "GHSA-9cqp-hgpj-49wr",
  "modified": "2026-06-19T00:31:37Z",
  "published": "2026-06-19T00:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54130"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54130"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9CRC-XJGP-V484

Vulnerability from github – Published: 2022-05-21 00:01 – Updated: 2025-12-09 18:30
VLAI
Details

A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-29881"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-20T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P850 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00), SICAM P855 (All versions \u003c V3.00). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details.",
  "id": "GHSA-9crc-xjgp-v484",
  "modified": "2025-12-09T18:30:26Z",
  "published": "2022-05-21T00:01:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29881"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-165073.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-471761.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9CWQ-XR29-C4RP

Vulnerability from github – Published: 2026-08-18 18:32 – Updated: 2026-08-18 18:32
VLAI
Details

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-71878"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T18:19:32Z",
    "severity": "CRITICAL"
  },
  "details": "Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass",
  "id": "GHSA-9cwq-xr29-c4rp",
  "modified": "2026-08-18T18:32:03Z",
  "published": "2026-08-18T18:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71878"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gbif/ipt/issues/3115"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0014.md"
    },
    {
      "type": "WEB",
      "url": "https://www.gbif.org/ipt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9F43-FMC5-62GF

Vulnerability from github – Published: 2026-09-11 18:31 – Updated: 2026-09-11 18:31
VLAI
Details

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-89263"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T16:17:51Z",
    "severity": "MODERATE"
  },
  "details": "MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.",
  "id": "GHSA-9f43-fmc5-62gf",
  "modified": "2026-09-11T18:31:25Z",
  "published": "2026-09-11T18:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89263"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/moxi159753/mogu_blog_v2/releases"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C08_comment_closeEmailNotification.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moxi624/mogu_blog_v2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-on-the-comment-email-notification-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-9F7C-C5P3-FWR6

Vulnerability from github – Published: 2026-08-18 21:33 – Updated: 2026-08-18 21:33
VLAI
Details

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-70973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T21:17:55Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).   The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-9f7c-c5p3-fwr6",
  "modified": "2026-08-18T21:33:23Z",
  "published": "2026-08-18T21:33:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70973"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9G39-JGF9-9MXX

Vulnerability from github – Published: 2022-05-24 17:14 – Updated: 2022-05-24 17:14
VLAI
Details

A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.7.8 (build 20191105123929) allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-9004"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-14T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.7.8 (build 20191105123929) allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges.",
  "id": "GHSA-9g39-jgf9-9mxx",
  "modified": "2022-05-24T17:14:18Z",
  "published": "2022-05-24T17:14:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9004"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-9004-Authenticated%20Remote%20Authorization%20Bypass%20Leading%20to%20RCE-Wowza"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2020-9004.txt"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/master/wowza-streaming-engine/CVE-2020-9004.txt"
    },
    {
      "type": "WEB",
      "url": "https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9GCP-5C92-HP8C

Vulnerability from github – Published: 2026-05-28 21:32 – Updated: 2026-05-28 21:32
VLAI
Details

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-46826"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-28T21:16:32Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-9gcp-5c92-hp8c",
  "modified": "2026-05-28T21:32:06Z",
  "published": "2026-05-28T21:32:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46826"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspumay2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-9GFJ-28HW-JCHP

Vulnerability from github – Published: 2026-09-25 19:32 – Updated: 2026-09-25 19:32
VLAI
Summary
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
Details

Overview

Verified. Multiple Unrestricted Path Traversal vulnerabilities exist in the Knowns MCP docs and memory tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (Get, Create, Update, Rename, Delete) in both doc_store.go and memory_store.go concatenate user-controlled paths with filepath.Join() without any containment validation.

Additionally, the docs.update action with a newPath parameter performs a file deletion via Rename(), but is classified as CapWrite in the permission registry rather than CapDelete. This allows an attacker with a read-write-no-delete preset to bypass deletion restrictions and destroy arbitrary files outside the project root.

Affected paths

File Path Role Vulnerability & Execution Impact
internal/storage/doc_store.go Vulnerable Sink (Docs) Path Traversal in File Operations (CWE-22): Get(), Create(), Update(), Rename(), Delete() join user-controlled path with filepath.Join(ds.docsDir(), ...) without validating path containment.
internal/storage/memory_store.go Vulnerable Sink (Memory) Path Traversal in Memory Operations (CWE-22): GetInLayer(), Create(), Update(), Delete() join user-controlled id with filepath.Join(dir, models.MemoryFileName(id)) without validation.
internal/mcp/handlers/doc.go Pass-Through Handler Unsanitized Input Propagation: MCP handlers pass user-supplied path, folder, newPath directly to storage layer without sanitization.
internal/mcp/handlers/memory.go Pass-Through Handler Unsanitized Input Propagation: MCP handlers pass user-supplied id directly to storage layer without sanitization.
internal/permissions/registry.go Authorization Bypass Capability Misclassification (CWE-863): docs.update with newPath performs file deletion but is classified as CapWrite, bypassing CapDelete restrictions.

Root Cause

Missing Path Containment in DocStore

In internal/storage/doc_store.go, all file operations use filepath.Join() to construct absolute paths without validating that the resolved path remains within docsDir():

// Get retrieves a doc by its relative path (without .md extension).
func (ds *DocStore) Get(path string) (*models.Doc, error) {
    path = strings.TrimPrefix(path, "/")
    path = strings.TrimSuffix(path, ".md")

    // VULNERABLE: No containment check
    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+".md")
    if _, err := os.Stat(absPath); err == nil {
        // ...
        return ds.parseFile(absPath, path, folder, false, "")
    }
    // ...
}

// Create writes a new doc to .knowns/docs/{path}.md.
func (ds *DocStore) Create(doc *models.Doc) error {
    if doc.Path == "" {
        return fmt.Errorf("doc path is required")
    }
    // VULNERABLE: No containment check
    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md")
    if err := os.MkdirAll(filepath.Dir(absPath), 0755); err != nil {
        return fmt.Errorf("create doc dir: %w", err)
    }
    return ds.writeFile(absPath, doc)
}

// Rename rewrites a doc to a new path and removes the old file.
func (ds *DocStore) Rename(oldPath string, doc *models.Doc) error {
    // ...
    oldAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(oldPath, ".md"))+".md")
    newAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(doc.Path, ".md"))+".md")
    // ...
    if err := ds.writeFile(newAbsPath, doc); err != nil {
        return err
    }
    if oldAbsPath != newAbsPath {
        // VULNERABLE: Deletes file at oldAbsPath (can be outside docsDir)
        if err := os.Remove(oldAbsPath); err != nil && !os.IsNotExist(err) {
            return err
        }
    }
    return nil
}

// Delete removes a doc file.
func (ds *DocStore) Delete(path string) error {
    path = strings.TrimSuffix(path, ".md")
    // VULNERABLE: No containment check
    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+".md")
    return os.Remove(absPath)
}

Critical Flaws: - filepath.Join resolves ../ sequences natively - No post-Join prefix check (e.g., strings.HasPrefix(absPath, ds.docsDir())) - No rejection of absolute paths or path traversal sequences - Rename() performs file deletion via os.Remove(oldAbsPath), which can target files outside the docs directory

Missing Path Containment in MemoryStore

In internal/storage/memory_store.go, memory operations similarly lack path validation:

// GetInLayer retrieves a memory entry by ID from a specific layer only.
func (ms *MemoryStore) GetInLayer(id, layer string) (*models.MemoryEntry, error) {
    // ...
    dir, err := ms.dirForLayer(layer)
    if err != nil {
        return nil, err
    }
    // VULNERABLE: No containment check for id containing "../"
    absPath := filepath.Join(dir, models.MemoryFileName(id))
    if _, err := os.Stat(absPath); err != nil {
        return nil, fmt.Errorf("memory %q not found in %s layer", id, layer)
    }
    return ms.parseFile(absPath, layer)
}

// Create writes a new memory entry to the appropriate layer directory.
func (ms *MemoryStore) Create(entry *models.MemoryEntry) error {
    // ...
    dir, err := ms.dirForLayer(entry.Layer)
    if err != nil {
        return err
    }
    if err := os.MkdirAll(dir, 0755); err != nil {
        return fmt.Errorf("create memory dir: %w", err)
    }

    // VULNERABLE: No containment check for entry.ID containing "../"
    absPath := filepath.Join(dir, models.MemoryFileName(entry.ID))
    return atomicWrite(absPath, []byte(renderMemory(entry)))
}

// Delete removes a memory entry by ID.
func (ms *MemoryStore) Delete(id string) error {
    // ...
    filename := models.MemoryFileName(id)

    dirs := []string{ms.projectDir(), ms.globalDir()}
    for _, dir := range dirs {
        // VULNERABLE: No containment check
        absPath := filepath.Join(dir, filename)
        if _, err := os.Stat(absPath); err == nil {
            return os.Remove(absPath)
        }
    }

    return fmt.Errorf("memory %q not found", id)
}

Authorization Bypass via Rename-as-Delete

In internal/mcp/handlers/doc.go, the handleDocUpdate() function accepts a newPath parameter that triggers a rename operation:

func handleDocUpdate(getStore func() *storage.Store, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {
    // ...
    if v, ok := stringArg(args, "newPath"); ok && strings.TrimSpace(v) != "" {
        doc.Path = strings.Trim(strings.TrimSuffix(v, ".md"), "/")
    }
    // ...
    if oldPath != doc.Path {
        if err := store.Docs.Rename(oldPath, doc); err != nil {
            return errFailed("rename doc", err)
        }
        // ...
    }
    // ...
}

The Rename() function in doc_store.go performs file deletion:

if oldAbsPath != newAbsPath {
    if err := os.Remove(oldAbsPath); err != nil && !os.IsNotExist(err) {
        return err
    }
}

However, in internal/permissions/registry.go, docs.update is classified as CapWrite:

"docs.update":  {Capability: CapWrite, Target: TargetDoc, Risk: RiskMedium},

This allows an attacker with a read-write-no-delete preset (which permits CapWrite but denies CapDelete) to delete files by using docs.update with a newPath parameter.

Attack Vector

Phase Request / Action Effect
1. Arbitrary File Read docs.get with path="../../../victim/secret" Server reads file outside project root via path traversal in DocStore.Get().
2. Arbitrary File Write docs.create with folder="../../../victim" Server writes file outside project root via path traversal in DocStore.Create().
3. Arbitrary File Delete docs.update with path="../outside/secret.md" and newPath="../../../victim/renamed.md" Server deletes file outside project root via path traversal in DocStore.Rename(). Bypasses CapDelete restriction because docs.update is classified as CapWrite.
4. Memory File Read/Write memory.update with id="x/../../../../victim/secret" Server reads and overwrites file outside project root via path traversal in MemoryStore.Update().

Analysis

Classic Path Traversal Pattern

Both DocStore and MemoryStore follow the same vulnerable pattern: user-controlled input is concatenated with a base directory using filepath.Join(), then passed directly to file system operations (os.ReadFile, os.WriteFile, os.Remove, os.Stat) without any validation.

absPath := filepath.Join(baseDir, filepath.FromSlash(userInput))
// No containment check: strings.HasPrefix(absPath, baseDir)
// No rejection of ".." or absolute paths

filepath.Join resolves ../ sequences, allowing attackers to escape the intended directory: - Input: "../../../etc/passwd" - Result: /project/.knowns/docs/../../../etc/passwd → /etc/passwd

Rename-as-Delete Authorization Bypass

The Rename() function performs two operations: 1. Write the file to the new location (newAbsPath) 2. Delete the file from the old location (oldAbsPath)

Both paths are vulnerable to traversal. An attacker can: - Set path to a file outside the project (e.g., "../../../victim/target.md") - Set newPath to another location outside the project - The Rename() function will delete the file at path (outside the project)

Because docs.update is classified as CapWrite rather than CapDelete, this operation bypasses deletion restrictions in read-write-no-delete presets.

Compounding Factor - Unauthenticated Access

Due to the previously identified Auth Bypass vulnerability, all MCP tools are accessible without credentials when the server is started without a password, making this a zero-credential attack.

Fix

Patch is available right now at New Release.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.29.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "knowns"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.30.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-86439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-306",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-25T19:32:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Overview\n\nVerified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memory` tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions (`Get`, `Create`, `Update`, `Rename`, `Delete`) in both `doc_store.go` and `memory_store.go` concatenate user-controlled paths with `filepath.Join()` without any containment validation. \n\nAdditionally, the `docs.update` action with a `newPath` parameter performs a file deletion via `Rename()`, but is classified as `CapWrite` in the permission registry rather than `CapDelete`. This allows an attacker with a `read-write-no-delete` preset to bypass deletion restrictions and destroy arbitrary files outside the project root.\n\n## Affected paths\n\n| File Path | Role | Vulnerability \u0026 Execution Impact |\n| :--- | :--- | :--- |\n| **`internal/storage/doc_store.go`** | Vulnerable Sink (Docs) | **Path Traversal in File Operations (CWE-22):** `Get()`, `Create()`, `Update()`, `Rename()`, `Delete()` join user-controlled `path` with `filepath.Join(ds.docsDir(), ...)` without validating path containment. |\n| **`internal/storage/memory_store.go`** | Vulnerable Sink (Memory) | **Path Traversal in Memory Operations (CWE-22):** `GetInLayer()`, `Create()`, `Update()`, `Delete()` join user-controlled `id` with `filepath.Join(dir, models.MemoryFileName(id))` without validation. |\n| **`internal/mcp/handlers/doc.go`** | Pass-Through Handler | **Unsanitized Input Propagation:** MCP handlers pass user-supplied `path`, `folder`, `newPath` directly to storage layer without sanitization. |\n| **`internal/mcp/handlers/memory.go`** | Pass-Through Handler | **Unsanitized Input Propagation:** MCP handlers pass user-supplied `id` directly to storage layer without sanitization. |\n| **`internal/permissions/registry.go`** | Authorization Bypass | **Capability Misclassification (CWE-863):** `docs.update` with `newPath` performs file deletion but is classified as `CapWrite`, bypassing `CapDelete` restrictions. |\n\n## Root Cause\n\n### Missing Path Containment in DocStore\n\nIn `internal/storage/doc_store.go`, all file operations use `filepath.Join()` to construct absolute paths without validating that the resolved path remains within `docsDir()`:\n\n```go\n// Get retrieves a doc by its relative path (without .md extension).\nfunc (ds *DocStore) Get(path string) (*models.Doc, error) {\n    path = strings.TrimPrefix(path, \"/\")\n    path = strings.TrimSuffix(path, \".md\")\n\n    // VULNERABLE: No containment check\n    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+\".md\")\n    if _, err := os.Stat(absPath); err == nil {\n        // ...\n        return ds.parseFile(absPath, path, folder, false, \"\")\n    }\n    // ...\n}\n\n// Create writes a new doc to .knowns/docs/{path}.md.\nfunc (ds *DocStore) Create(doc *models.Doc) error {\n    if doc.Path == \"\" {\n        return fmt.Errorf(\"doc path is required\")\n    }\n    // VULNERABLE: No containment check\n    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+\".md\")\n    if err := os.MkdirAll(filepath.Dir(absPath), 0755); err != nil {\n        return fmt.Errorf(\"create doc dir: %w\", err)\n    }\n    return ds.writeFile(absPath, doc)\n}\n\n// Rename rewrites a doc to a new path and removes the old file.\nfunc (ds *DocStore) Rename(oldPath string, doc *models.Doc) error {\n    // ...\n    oldAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(oldPath, \".md\"))+\".md\")\n    newAbsPath := filepath.Join(ds.docsDir(), filepath.FromSlash(strings.TrimSuffix(doc.Path, \".md\"))+\".md\")\n    // ...\n    if err := ds.writeFile(newAbsPath, doc); err != nil {\n        return err\n    }\n    if oldAbsPath != newAbsPath {\n        // VULNERABLE: Deletes file at oldAbsPath (can be outside docsDir)\n        if err := os.Remove(oldAbsPath); err != nil \u0026\u0026 !os.IsNotExist(err) {\n            return err\n        }\n    }\n    return nil\n}\n\n// Delete removes a doc file.\nfunc (ds *DocStore) Delete(path string) error {\n    path = strings.TrimSuffix(path, \".md\")\n    // VULNERABLE: No containment check\n    absPath := filepath.Join(ds.docsDir(), filepath.FromSlash(path)+\".md\")\n    return os.Remove(absPath)\n}\n```\n\n**Critical Flaws:**\n- `filepath.Join` resolves `../` sequences natively\n- No post-Join prefix check (e.g., `strings.HasPrefix(absPath, ds.docsDir())`)\n- No rejection of absolute paths or path traversal sequences\n- `Rename()` performs file deletion via `os.Remove(oldAbsPath)`, which can target files outside the docs directory\n\n### Missing Path Containment in MemoryStore\n\nIn `internal/storage/memory_store.go`, memory operations similarly lack path validation:\n\n```go\n// GetInLayer retrieves a memory entry by ID from a specific layer only.\nfunc (ms *MemoryStore) GetInLayer(id, layer string) (*models.MemoryEntry, error) {\n    // ...\n    dir, err := ms.dirForLayer(layer)\n    if err != nil {\n        return nil, err\n    }\n    // VULNERABLE: No containment check for id containing \"../\"\n    absPath := filepath.Join(dir, models.MemoryFileName(id))\n    if _, err := os.Stat(absPath); err != nil {\n        return nil, fmt.Errorf(\"memory %q not found in %s layer\", id, layer)\n    }\n    return ms.parseFile(absPath, layer)\n}\n\n// Create writes a new memory entry to the appropriate layer directory.\nfunc (ms *MemoryStore) Create(entry *models.MemoryEntry) error {\n    // ...\n    dir, err := ms.dirForLayer(entry.Layer)\n    if err != nil {\n        return err\n    }\n    if err := os.MkdirAll(dir, 0755); err != nil {\n        return fmt.Errorf(\"create memory dir: %w\", err)\n    }\n\n    // VULNERABLE: No containment check for entry.ID containing \"../\"\n    absPath := filepath.Join(dir, models.MemoryFileName(entry.ID))\n    return atomicWrite(absPath, []byte(renderMemory(entry)))\n}\n\n// Delete removes a memory entry by ID.\nfunc (ms *MemoryStore) Delete(id string) error {\n    // ...\n    filename := models.MemoryFileName(id)\n\n    dirs := []string{ms.projectDir(), ms.globalDir()}\n    for _, dir := range dirs {\n        // VULNERABLE: No containment check\n        absPath := filepath.Join(dir, filename)\n        if _, err := os.Stat(absPath); err == nil {\n            return os.Remove(absPath)\n        }\n    }\n\n    return fmt.Errorf(\"memory %q not found\", id)\n}\n```\n\n### Authorization Bypass via Rename-as-Delete\n\nIn `internal/mcp/handlers/doc.go`, the `handleDocUpdate()` function accepts a `newPath` parameter that triggers a rename operation:\n\n```go\nfunc handleDocUpdate(getStore func() *storage.Store, req mcp.CallToolRequest) (*mcp.CallToolResult, error) {\n    // ...\n    if v, ok := stringArg(args, \"newPath\"); ok \u0026\u0026 strings.TrimSpace(v) != \"\" {\n        doc.Path = strings.Trim(strings.TrimSuffix(v, \".md\"), \"/\")\n    }\n    // ...\n    if oldPath != doc.Path {\n        if err := store.Docs.Rename(oldPath, doc); err != nil {\n            return errFailed(\"rename doc\", err)\n        }\n        // ...\n    }\n    // ...\n}\n```\n\nThe `Rename()` function in `doc_store.go` performs file deletion:\n\n```go\nif oldAbsPath != newAbsPath {\n    if err := os.Remove(oldAbsPath); err != nil \u0026\u0026 !os.IsNotExist(err) {\n        return err\n    }\n}\n```\n\nHowever, in `internal/permissions/registry.go`, `docs.update` is classified as `CapWrite`:\n\n```go\n\"docs.update\":  {Capability: CapWrite, Target: TargetDoc, Risk: RiskMedium},\n```\n\nThis allows an attacker with a `read-write-no-delete` preset (which permits `CapWrite` but denies `CapDelete`) to delete files by using `docs.update` with a `newPath` parameter.\n\n## Attack Vector\n\n| Phase | Request / Action | Effect |\n| :--- | :--- | :--- |\n| **1. Arbitrary File Read** | `docs.get` with `path=\"../../../victim/secret\"` | Server reads file outside project root via path traversal in `DocStore.Get()`. |\n| **2. Arbitrary File Write** | `docs.create` with `folder=\"../../../victim\"` | Server writes file outside project root via path traversal in `DocStore.Create()`. |\n| **3. Arbitrary File Delete** | `docs.update` with `path=\"../outside/secret.md\"` and `newPath=\"../../../victim/renamed.md\"` | Server deletes file outside project root via path traversal in `DocStore.Rename()`. Bypasses `CapDelete` restriction because `docs.update` is classified as `CapWrite`. |\n| **4. Memory File Read/Write** | `memory.update` with `id=\"x/../../../../victim/secret\"` | Server reads and overwrites file outside project root via path traversal in `MemoryStore.Update()`. |\n\n## Analysis\n\n### Classic Path Traversal Pattern\n\nBoth `DocStore` and `MemoryStore` follow the same vulnerable pattern: user-controlled input is concatenated with a base directory using `filepath.Join()`, then passed directly to file system operations (`os.ReadFile`, `os.WriteFile`, `os.Remove`, `os.Stat`) without any validation.\n\n```go\nabsPath := filepath.Join(baseDir, filepath.FromSlash(userInput))\n// No containment check: strings.HasPrefix(absPath, baseDir)\n// No rejection of \"..\" or absolute paths\n```\n\n`filepath.Join` resolves `../` sequences, allowing attackers to escape the intended directory:\n- Input: `\"../../../etc/passwd\"`\n- Result: `/project/.knowns/docs/../../../etc/passwd` \u2192 `/etc/passwd`\n\n### Rename-as-Delete Authorization Bypass\n\nThe `Rename()` function performs two operations:\n1. Write the file to the new location (`newAbsPath`)\n2. Delete the file from the old location (`oldAbsPath`)\n\nBoth paths are vulnerable to traversal. An attacker can:\n- Set `path` to a file outside the project (e.g., `\"../../../victim/target.md\"`)\n- Set `newPath` to another location outside the project\n- The `Rename()` function will delete the file at `path` (outside the project)\n\nBecause `docs.update` is classified as `CapWrite` rather than `CapDelete`, this operation bypasses deletion restrictions in `read-write-no-delete` presets.\n\n### Compounding Factor - Unauthenticated Access\n\nDue to the previously identified **Auth Bypass** vulnerability, all MCP tools are accessible without credentials when the server is started without a password, making this a zero-credential attack.\n\n## Fix\n\n*Patch is available right now at [New Release](https://github.com/knowns-dev/knowns/releases).*",
  "id": "GHSA-9gfj-28hw-jchp",
  "modified": "2026-09-25T19:32:05Z",
  "published": "2026-09-25T19:32:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/security/advisories/GHSA-9gfj-28hw-jchp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86439"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/knowns-dev/knowns"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/doc_store.go#L124-L129"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/storage/memory_store.go#L203-L211"
    },
    {
      "type": "WEB",
      "url": "https://github.com/knowns-dev/knowns/releases/tag/v0.30.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-mcp-doc-and-memory-tools"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools"
}

GHSA-9GG2-WJ6F-29QM

Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08
VLAI
Details

A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier) that could cause unauthorized operation when authentication is bypassed.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-22772"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-21T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier) that could cause unauthorized operation when authentication is bypassed.",
  "id": "GHSA-9gg2-wj6f-29qm",
  "modified": "2022-05-24T19:08:47Z",
  "published": "2022-05-24T19:08:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22772"
    },
    {
      "type": "WEB",
      "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Architecture and Design
  • Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
  • Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
  • In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation
Architecture and Design
  • Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
  • In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
Implementation System Configuration Operation

When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

CAPEC-12: Choosing Message Identifier

This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.

CAPEC-166: Force the System to Reset Values

An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.

CAPEC-216: Communication Channel Manipulation

An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.

CAPEC-36: Using Unpublished Interfaces or Functionality

An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.

CAPEC-62: Cross Site Request Forgery

An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

← Back to the CWE list