CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31450 – Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
https://notcve.org/view.php?id=CVE-2024-31450
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. • https://github.com/owncast/owncast/blob/v0.1.2/controllers/admin/emoji.go#L63 https://github.com/owncast/owncast/commit/1b14800c7d7f54be14ed4d130bfe7f480645076e https://github.com/owncast/owncast/releases/tag/v0.1.3 https://securitylab.github.com/advisories/GHSL-2023-277_Owncast • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29026 – Owncast cross origin request
https://notcve.org/view.php?id=CVE-2024-29026
Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue. Owncast es un servidor de chat y transmisión de video en vivo de código abierto, autohospedado, descentralizado y de un solo usuario. • https://github.com/owncast/owncast/blob/v0.1.2/router/middleware/auth.go#L32 https://github.com/owncast/owncast/commit/9215d9ba0f29d62201d3feea9e77dcd274581624 https://securitylab.github.com/advisories/GHSL-2023-261_Owncast • CWE-352: Cross-Site Request Forgery (CSRF) CWE-697: Incorrect Comparison •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46480
https://notcve.org/view.php?id=CVE-2023-46480
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function. Un problema en OwnCast v.0.1.1 permite a un atacante remoto ejecutar código arbitrario y obtener información confidencial a través del parámetro authHost de la función indieauth. • https://github.com/shahzaibak96/CVE-2023-46480 https://github.com/owncast/owncast • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-918: Server-Side Request Forgery (SSRF) •