Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. Details Affected conponent: apps/web/src/routes/api/tunnel/register.ts - /tunnel/register endpoint code-: - It checks if the tunnel exists in the database. - Limit is checked here-: - Redis is checked for existing tunnel to check for reconnection. - If the tunnel limit is exceeded, it pops up the tunnel limit error. - If the limit is not exceeded, it triggers a the Insert Statement without locking transactions from other request - If parallel requests are made by the wshandler in /outray/outray-main/apps/tunnel/src/core/WSHandler.ts from the command line app. A request can work on a non updated row because the insert row has not been triggered allowing the user to bypass the limit. It is much explained in the proof of concept. The key takeaway is db transactions should remain locked. PoC Using this simple bash script, the outray binary will be run at the…
Recommended action: Upgrade to 0.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in https://github.com/akinloluwami/outray/blob/main/apps/web/src/routes/api/%24orgSlug/subdomains/index.ts Details - The affected code-: - The first part of the code checks the user plan and determine his/her existingdomains without locking the transaction and allowing it to run. - The other part of the code checks if the desired domain is more than the limit. - Finally, it inserts the subdomain also after the whole check without locking transactions. - An attacker can exploit this by making parallel requests to the same endpoint and if the second request reads row subdomains before the INSERT statement of request one is made.It allows the attacker to act on a not yet updated row which bypasses the checks and allow the attacker to get more subdomains.For example-: - The attack focuses on exploiting the race window between reading and…
Recommended action: Upgrade to 0.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.