| शीर्षक | cu silicon 0.1.5 Authentication Bypass |
|---|
| विवरण | Silicon is a Flask-based personal knowledge base with 262 GitHub stars. The entire application has zero authentication - no login page, no session check, no password protection, no middleware. All write endpoints are publicly accessible without any form of authentication. An unauthenticated attacker can create, edit, or modify any page in the knowledge base via POST requests to /edit/<title>. Other write endpoints like /toc (POST) and /related/<title> (POST/DELETE) are equally unprotected. The code in views.py has no @login_required decorators, no session checks, and no auth middleware. The create_app() factory in __init__.py does not register any authentication mechanism. This allows complete defacement or data manipulation of any silicon instance exposed to the network.
PoC:
POST /edit/pocpage HTTP/1.1
Content-Type: application/x-www-form-urlencoded
body=%23+HACKED%0A%0ANo+authentication+required
The page is immediately modified and serves the injected content to all visitors. |
|---|
| स्रोत | ⚠️ https://github.com/cu/silicon |
|---|
| उपयोगकर्ता | BRabbit (UID 99520) |
|---|
| सबमिशन | 03/07/2026 12:10 PM (2 महीनों पहले) |
|---|
| संयम | 31/08/2026 01:16 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397299 [cu silicon तक 0.1.5 edit Endpoint views.py create_app कमजोर प्रमाणीकरण] |
|---|
| अंक | 19 |
|---|