stoatchat vulnerabilities

January, the media proxy/embed service of stoatchat, before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding.

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, relying only on IP-based rate limiting. An attacker who knows a password can guess TOTP codes by reusing MFA challenge tickets and distributing guesses across IP addresses to bypass rate limiting and gain account access.

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. An unauthenticated attacker can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. An authenticated user can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.

stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.

stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

An SSRF vulnerability in stoatchat before 0.14.0 allows unauthenticated attackers to bypass DNS-based IP blocklists. The url_is_blacklisted function only inspects the first resolved address, while the HTTP client iterates all cached addresses.

Stoatchat before version 0.13.5 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains.

A vulnerability in stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allows users with ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, due to checking ViewChannel instead of ManageWebhooks in the webhook fetch endpoint.

In stoatchat (delta) versions before 20250210-1 (0.8.2), a logic error exists in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.

A vulnerability in Stoatchat before version 0.7.8 allows attackers to bypass account creation restrictions such as invite-only mode, email verification, captcha, and shield verification. This enables unlimited account creation with unverified email addresses, increasing the risk of denial-of-service attacks and compromising service integrity.