Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. Affected versions ShellHub Community v0.24.1 (validated). Root cause api/routes/nsadm.go:75-102 — membership check is skipped when c.ID() is nil: AuthRequest (api/routes/auth.go:53-64) sets only X-Tenant-ID, X-Role, and X-API-KEY for API Key authentication — never X-ID. So c.Request().Header.Get("X-ID") returns "", c.ID() returns nil, and the membership check is bypassed. Proof of concept (validated live against v0.24.1) Impact - Enumeration of any ShellHub namespace by tenant UUID. - Disclosure of member e-mails, user IDs, and roles → user enumeration and targeted phishing against the…
Recommended action: Upgrade to 0.24.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The device list endpoint accepts user-controlled identifiers in two places that are passed directly as BSON/SQL keys in the database layer without validation: 1. The name field of each filter property in the base64-encoded filter query parameter. 2. The sortby query parameter. Any authenticated user can craft payloads that cause the aggregation/query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. Severity CVSS 3.1: 6.5 (Medium) CWE-20 (Improper Input Validation) CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) Affected versions ShellHub Community v0.24.1 (validated). All versions sharing the same filter and sort pipeline (api/store/mongo/query-options.go). Root cause Vector 1 — Filter field name api/store/mongo/query-options.go:140: param.Name is the name field from the JSON filter supplied by the client. It becomes a BSON map key with no validation, allowing BSON operator names ($where, $ne, $or, $regex) and…
Recommended action: Upgrade to 0.24.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. Severity CVSS 3.1: 7.5 (High) CWE-639 Affected versions ShellHub Community v0.24.1 (by code inspection — same vulnerable pattern as GetDevice). Not plant-reproducible without an active SSH session, but the flaw is structurally identical and confirmed via static analysis. Root cause api/services/session.go:37-44 — GetSession resolves the session by UID without any tenant filter: The Authorize middleware only verifies presence of a tenant in the context, not ownership of the requested session. Proof of concept Pre-requisite: attacker has any valid user account and has obtained a session UID from the victim tenant (UIDs may leak via logs, shared session recordings, UI URLs, or through the…
Recommended action: Upgrade to 0.24.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller's namespace (tenant). Any authenticated user (JWT or API Key) who knows or can guess a device UID can read device metadata from any other namespace. Severity CVSS 3.1: 7.5 (High) CWE-639 — Authorization Bypass Through User-Controlled Key Affected versions ShellHub Community v0.24.1 (validated). Likely all prior versions that share this handler. Root cause api/services/device.go:97-104 — GetDevice resolves the device by UID without scoping to the caller's tenant: Compare with DeleteDevice in the same file (line 137) which correctly applies InNamespace(tenant). The Authorize middleware (api/routes/middleware/authorize.go:12-27) only checks that a tenant is present in the context — not that the resource belongs to that tenant. Proof of concept (validated live against v0.24.1) Pre-requisite: attacker has any valid user account and…
Recommended action: Upgrade to 0.24.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.