| عنوان | volotat Anagnorisis 0.4.0 Missing Authentication |
|---|
| الوصف | A missing authentication vulnerability exists in the Socket.IO interface of volotat Anagnorisis 0.4.0. The product enables HTTP Basic Authentication when ANAGNORISIS_USERNAME and ANAGNORISIS_PASSWORD are configured and applies it through a Flask before_request hook. The Socket.IO connect handler and subsequent Socket.IO events do not enforce the configured credentials.
In an isolated loopback reproduction using commit acce76065cd4cecf6eaed5bee8691e95c85964d4, an unauthenticated HTTP request returned 401 while a Socket.IO client without credentials connected successfully and invoked the read-only task_manager_get_state event. The response exposed the active, history, queued and schedulers state keys. Other registered events perform database import, configuration, media-library and model-training operations.
The root cause is an inconsistent authentication boundary between Flask HTTP requests and Socket.IO connections. The wildcard Socket.IO Origin policy increases browser reachability but is treated as a secondary hardening issue rather than a separate vulnerability.
|
|---|
| المصدر | ⚠️ https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi |
|---|
| المستخدم | hiro (UID 93548) |
|---|
| ارسال | 29/07/2026 02:25 AM (2 أشهر منذ) |
|---|
| الاعتدال | 24/09/2026 12:12 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 409321 [volotat Anagnorisis حتى 0.3.1/0.4.0 Socket.IO Connect Interface app.py توثيق ضعيف] |
|---|
| النقاط | 20 |
|---|