-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| azuracast/azuracast | composer | <= 0.23.1 | 0.23.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two internal API endpoints, /api/internal/sftp-event and /api/internal/sftp-auth, being incorrectly exposed to the public internet. These endpoints were intended for communication with an internal SFTP service. The analysis of the patch commit 34620dbad93f6cd8e209a4220e3e53c7c5fea844 reveals that the fix was to introduce and apply a new middleware, App\Middleware\RequireInternalConnection. This middleware restricts access to these endpoints to requests originating from within the application's local container environment.
The routing configuration file backend/config/routes/api_internal.php explicitly maps these endpoints to the App\Controller\Api\Internal\SftpEventAction and App\Controller\Api\Internal\SftpAuthAction controller classes. Since these controllers were invoked without the necessary authorization check prior to the patch, their main handler methods (typically __invoke in this framework) are the vulnerable functions. Exploitation involves sending a crafted HTTP POST request to these endpoints, which would then be processed by these vulnerable functions, leading to unintended actions like the deletion of database records.
App\Controller\Api\Internal\SftpEventAction::__invokebackend/config/routes/api_internal.php
App\Controller\Api\Internal\SftpAuthAction::__invokebackend/config/routes/api_internal.php
A Semantic Attack on Google Gemini - Read the Latest Research