Studio-Saelix Sencho vulnerabilities

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1 affecting unknown code of the file outboundTarget.ts of the git-sources Browse API Endpoint component. Manipulation of the repo_url argument can lead to server-side request forgery, and the attack may be performed remotely. The exploit has been publicly disclosed and may be utilized; the patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72.

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1 affecting the file /api/auth/login of the Login Endpoint component. Manipulation of the X-Forwarded-For argument results in improper authentication, and the attack can be carried out remotely. The exploit has been made public and could be used; the patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72.

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1 affecting the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the Add Remote Node API Endpoint component. Manipulation leads to server-side request forgery, and the attack can be executed remotely. The exploit has been disclosed to the public and may be used; the vendor confirms that the node API URL could be configured by an authenticated user with node-management permission.