| शीर्षक | volotat Anagnorisis 0.4.0 Missing Authentication |
|---|
| विवरण | A missing authentication vulnerability exists in the Socket.IO interface of volotat Anagnorisis 0.4.0. The product enables HTTP Basic Authentication when ANAGNORISIS_USERNAME and ANAGNORISIS_PASSWORD are configured and applies it through a Flask before_request hook. The Socket.IO connect handler and subsequent Socket.IO events do not enforce the configured credentials.
In an isolated loopback reproduction using commit acce76065cd4cecf6eaed5bee8691e95c85964d4, an unauthenticated HTTP request returned 401 while a Socket.IO client without credentials connected successfully and invoked the read-only task_manager_get_state event. The response exposed the active, history, queued and schedulers state keys. Other registered events perform database import, configuration, media-library and model-training operations.
The root cause is an inconsistent authentication boundary between Flask HTTP requests and Socket.IO connections. The wildcard Socket.IO Origin policy increases browser reachability but is treated as a secondary hardening issue rather than a separate vulnerability.
|
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi |
|---|
| उपयोगकर्ता | hiro (UID 93548) |
|---|
| सबमिशन | 29/07/2026 02:25 AM (2 महीनों पहले) |
|---|
| संयम | 24/09/2026 12:12 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409321 [volotat Anagnorisis तक 0.3.1/0.4.0 Socket.IO Connect Interface app.py कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|