| タイトル | volotat Anagnorisis 0.4.0 Missing Authentication |
|---|
| 説明 | A missing authentication vulnerability exists in the Socket.IO interface of volotat Anagnorisis 0.4.0. The product enables HTTP Basic Authentication when ANAGNORISIS_USERNAME and ANAGNORISIS_PASSWORD are configured and applies it through a Flask before_request hook. The Socket.IO connect handler and subsequent Socket.IO events do not enforce the configured credentials.
In an isolated loopback reproduction using commit acce76065cd4cecf6eaed5bee8691e95c85964d4, an unauthenticated HTTP request returned 401 while a Socket.IO client without credentials connected successfully and invoked the read-only task_manager_get_state event. The response exposed the active, history, queued and schedulers state keys. Other registered events perform database import, configuration, media-library and model-training operations.
The root cause is an inconsistent authentication boundary between Flask HTTP requests and Socket.IO connections. The wildcard Socket.IO Origin policy increases browser reachability but is treated as a secondary hardening issue rather than a separate vulnerability.
|
|---|
| ソース | ⚠️ https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi |
|---|
| ユーザー | hiro (UID 93548) |
|---|
| 送信 | 2026年07月29日 02:25 (2 月 ago) |
|---|
| モデレーション | 2026年09月24日 12:12 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 409321 [volotat Anagnorisis 迄 0.3.1/0.4.0 Socket.IO Connect Interface app.py 弱い認証] |
|---|
| ポイント | 20 |
|---|