Threats affecting pkg:github/yogeshojha/rengine

reNgine versions up to 2.2.0 and the current master branch at the specified commit are vulnerable to OS Command Injection via the custom_headers scan engine configuration field. This vulnerability affects functions fetch_url and dir_file_fuzz in web/reNgine/tasks.py. It allows an unauthenticated attacker to execute arbitrary OS commands remotely, leading to full system compromise.

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter by querying the endpoint without role-based permission checks.