| Название | volotat Anagnorisis 0.4.0 Missing Authentication |
|---|
| Описание | A missing authentication vulnerability exists in the Socket.IO interface of volotat Anagnorisis 0.4.0. The product enables HTTP Basic Authentication when ANAGNORISIS_USERNAME and ANAGNORISIS_PASSWORD are configured and applies it through a Flask before_request hook. The Socket.IO connect handler and subsequent Socket.IO events do not enforce the configured credentials.
In an isolated loopback reproduction using commit acce76065cd4cecf6eaed5bee8691e95c85964d4, an unauthenticated HTTP request returned 401 while a Socket.IO client without credentials connected successfully and invoked the read-only task_manager_get_state event. The response exposed the active, history, queued and schedulers state keys. Other registered events perform database import, configuration, media-library and model-training operations.
The root cause is an inconsistent authentication boundary between Flask HTTP requests and Socket.IO connections. The wildcard Socket.IO Origin policy increases browser reachability but is treated as a secondary hardening issue rather than a separate vulnerability.
|
|---|
| Источник | ⚠️ https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi |
|---|
| Пользователь | hiro (UID 93548) |
|---|
| Представление | 29.07.2026 02:25 (2 месяцы назад) |
|---|
| Модерация | 24.09.2026 12:12 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 409321 [volotat Anagnorisis до 0.3.1/0.4.0 Socket.IO Connect Interface app.py слабая аутентификация] |
|---|
| Баллы | 20 |
|---|