Vulnerabilidades do Altium Altium 365

A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authenticated user with basic git access to move arbitrary files outside the intended repository area. This file-move primitive can be used to place attacker-controlled script content into directories where it is later executed by the service, resulting in remote code execution under the Git Service account. On multi-tenant Altium 365 deployments, this could have allowed access to data belonging to other tenants on the same infrastructure node. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system. An unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.

Existe uma vulnerabilidade de falta de autenticação no Altium 365 SearchService. Um endpoint SOAP legado expõe operações do índice de busca sem exigir autenticação, tokens de sessão ou qualquer forma de verificação de identidade. Um atacante de rede não autenticado que consiga referenciar o identificador do workspace de um alvo pode interagir com o índice de busca desse workspace, ultrapassando limites entre tenants. A exploração bem-sucedida permite ler o conteúdo indexado de um workspace, como dados de componentes, nomes de projetos e pastas e metadados de usuários, e injetar, modificar ou excluir entradas do índice de busca. Essas operações afetam apenas o índice de busca, não os dados do vault subjacente, mas podem divulgar informações sensíveis do workspace e comprometer a integridade e a disponibilidade dos resultados de busca. Implantações em nuvem do Altium 365 são afetadas; o Altium Enterprise Server local não é afetado.

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.