Threat database

Trudesk versions up to and including 1.2.11 have a path traversal and authorization bypass vulnerability in the accountsController.uploadImage function. Authenticated users can exploit this flaw by supplying crafted _id and username fields to overwrite other users' avatar images. The vulnerability bypasses prior sanitization attempts, allowing attackers to write image files outside the intended directory.

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.

Trudesk versions up to and including 1.2.11 have a missing authentication vulnerability in debug routes when NODE_ENV is unset. This allows unauthenticated attackers to remotely invoke debug endpoints such as /debug/populatedb, which can delete all groups, tags, and tickets. Attackers can then log in using seeded accounts with a default password.

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.

Trudesk versions up to 1.2.11 have an authorization bypass vulnerability allowing authenticated users to modify tickets outside their assigned groups. This occurs via the PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch endpoints, where arbitrary ticket ObjectIds can be supplied to change ticket attributes or mass-close tickets. The vulnerability arises because only the default tickets:update role is checked, enabling unauthorized ticket modifications.

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.

Trudesk versions up to and including 1.2.11 have an authorization bypass vulnerability that allows any authenticated user to access private conversations by specifying another conversation's ID. The API endpoint GET /api/v1/messages/conversation/:id does not verify if the requester is a participant in the conversation, exposing message history and participant details such as usernames, full names, and email addresses.