Appsmith vulnerabilities

Vulnerability in Appsmith before 1.93: the server uses the Origin header value as the email link baseUrl without validation. An attacker controlling Origin can cause password reset / email verification links to point to their domain, exposing authentication tokens and potentially leading to account takeover.

In Appsmith prior to version 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration.

Appsmith's SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

In appsmithorg appsmith up to version 1.97, there is a server-side request forgery (SSRF) vulnerability in the computeDisallowedHosts function in WebClientUtils.java in the Dashboard component. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability in Appsmith versions prior to 1.98 exposes sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains.