OCO-Server vulnerabilities

OCO-Server before 1.2.1 has a vulnerability where Html::commandButton() in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick handler, using htmlspecialchars(ENT_QUOTES) only for HTML escaping. Browsers decode HTML entities before interpreting the handler as JavaScript, so a crafted hostname can escape the string and execute script in an administrator's authenticated session when an affected command button is activated. A remote attacker with the shared agent-registration-key can store an unchecked hostname via oco.agent.hello when agent self-registration is enabled (disabled by default). The issue is fixed in version 1.2.1.

OCO-Server prior to 1.2.3 allows a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package to queue an uninstall job without deploy permission for those resources. The permission-check loop continues after denied checks without removing rejected IDs, then passes the original list to the uninstall function, which is executed in system context.

In OCO-Server prior to 1.2.3, the Apple MDM enrollment endpoint (frontend/api-mdm.php) verifies the signed enrollment-request plist with PKCS7_NOVERIFY, which disables signer certificate chain and trust validation. As a result, an attacker can sign a forged plist with any self-signed certificate, supply a known device's serial number, and via an unauthenticated request obtain the victim's MDM identity (certificate and private key) and overwrite the device record in the database.