Threats affecting pkg:github/opstree/rems

OpsTree Solutions REMS versions up to 1.0.0 have an authorization vulnerability that allows authenticated users with lower privileges to post comments as the incident creator on incidents they do not own. This improper attribution flaw enables attackers to impersonate higher-privileged users, such as Super Users, potentially corrupting incident timelines and audit trails.

OpsTree REMS versions up to 1.0.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated attackers can exploit this by uploading attachments with a spoofed text/html Content-Type, such as HTML files disguised with double extensions (e.g., test.html.pdf). When these files are previewed in REMS, the embedded JavaScript executes in the context of the victim's browser.

OpsTree Solutions REMS versions up to 1.0.0 contain a server-side request forgery (SSRF) vulnerability. Authenticated users can exploit the database Test Connection feature to make the backend server connect to arbitrary destinations, including localhost, internal network addresses, or attacker-controlled servers. This allows attackers to probe internal hosts and ports accessible from the REMS server.

OpsTree Solutions REMS version 1.0.0 and earlier contains a missing authentication vulnerability that allows unauthenticated remote attackers to access critical Governance API endpoints. Attackers can retrieve sensitive database credentials by sending requests without valid authorization tokens.

OpsTree Solutions REMS versions up to 1.0.0 have an authentication bypass vulnerability. An attacker can exploit this by sending a specially crafted login request with the is_local_auth field set to true and an invalid password for the admin account. This allows the attacker to obtain a valid JWT and gain SuperUser administrative access without proper authentication.

OpsTree Solutions REMS versions up to 1.0.0 contain a prompt injection vulnerability that allows authenticated users to disclose hidden system prompts by submitting crafted input to the chat API. This flaw enables attackers to bypass assistant rules and reveal internal orchestration instructions, potentially facilitating further prompt injection attacks.

OpsTree Solutions REMS versions up to 1.0.0 have an authorization bypass vulnerability that allows authenticated users to manipulate the reporter field of an incident. This flaw enables attackers to falsify incident attribution by sending crafted POST or PATCH requests, compromising the integrity of the accountability audit trail.