| タイトル | MODSetter SurfSense <=0.0.36 Missing Authorization |
|---|
| 説明 | SurfSense 0.0.36 accepts unauthenticated HTTP requests on the Circleback meeting webhook. The workspace identifier in the URL is a sequential integer and is not bound to a shared secret or user session. A remote attacker who can reach the API can create or overwrite meeting documents in any workspace knowledge base. No Circleback connector, account, or victim interaction is required. Injected content is stored, embedded, and later used by search and chat. |
|---|
| ソース | ⚠️ https://gist.github.com/DReazer/1e476832e48bcdb2b4f732689dfeac0c |
|---|
| ユーザー | Snkn0w (UID 90071) |
|---|
| 送信 | 2026年08月17日 05:43 (2 月 ago) |
|---|
| モデレーション | 2026年09月28日 20:46 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 411143 [MODSetter SurfSense 迄 2.0.3 circleback Endpoint circleback_webhook_route.py 弱い認証] |
|---|
| ポイント | 20 |
|---|