migration-planner vulnerabilities

A flaw was found in migration-planner that allows a remote authenticated attacker to upload a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within spreadsheet cells is executed when processing cluster names.

A flaw exists in the migration-planner where the agent-API middleware fails to properly validate the source_id claim in JWTs. This allows an authenticated attacker to manipulate data across different tenants, leading to a complete collapse of tenant isolation.

A flaw was found in migration-planner that allows an authenticated attacker to bypass access control in the `/api/v1/sources/{id}/image-url` endpoint. This flaw enables the attacker to obtain presigned S3 URLs for OVA images belonging to other users.

A flaw was found in migration-planner that allows an authenticated user to send a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This enables the destruction of all customer data, including sources, agents, and assessments.

A flaw in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.