Threat database

Pingvin Share X versions before 1.22.0 have a vulnerability in their authentication rate limiting mechanism. The throttler's time-to-live (TTL) values are specified in seconds but incorrectly interpreted as milliseconds, allowing attackers to bypass rate limits. This flaw enables unauthenticated attackers to send a high volume of requests to authentication endpoints, facilitating brute-force attacks on passwords and TOTP codes.

Pingvin Share X versions before 1.22.0 have a rate limit bypass vulnerability due to unconditional trust in proxy headers. This allows unauthenticated remote attackers to evade per-IP throttling by spoofing X-Forwarded-For headers. Attackers can exploit this to brute-force passwords and TOTP codes on authentication endpoints and forge logged client IP addresses.

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.

Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database.

Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) requirement entirely. Although, an attacker still needs the user's password to reach this stage. This vulnerability is fixed in 1.16.3.