Critical · published September 30, 2025
🚨 Unauthenticated API endpoints are like open windows in a fortress! Vasion Print appliances before version 22.0.1026 are leaking sensitive config files and clear-text passwords – a recipe for disaster! 🔥 Think of it like a restaurant kitchen where the chef has left the back door wide open, allowing anyone to waltz in and snoop around. An attacker can take advantage of this oversight to obtain critical secrets and make unauthorized changes. The consequences could be absolutely devastating! An attacker who gains access to the APP_KEY can craft malicious requests that the application will accept, leading to remote code execution. This means they could potentially take full control of your appliance, manipulating data and settings to their heart's content. Yikes! ⚡
Think of it like a restaurant kitchen where the chef has left the back door wide open, allowing anyone to waltz in and snoop around. An attacker can take advantage of this oversight to obtain critical secrets and make unauthorized changes. This vulnerability stems from a set of unauthenticated REST API endpoints that expose sensitive configuration and authentication data, including clear-text passwords and the Laravel APP_KEY. This key is crucial for generating valid signed requests, making it a prime target for attackers seeking remote code execution.
The consequences could be absolutely devastating! An attacker who gains access to the APP_KEY can craft malicious requests that the application will accept, leading to remote code execution. This means they could potentially take full control of your appliance, manipulating data and settings to their heart's content. Yikes! ⚡ Immediate patching is necessary! Upgrade your Vasion Print Virtual Appliance Host to version 22.0.1026 and Application to version 20.0.2702 to close these vulnerabilities. Review your API access controls to ensure only authenticated users can interact with sensitive endpoints. 🔒 You've got this! Follow these steps and you'll fortify your defenses in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| vasion/virtual_appliance_application | < 20.0.2702 | 20.0.2702 |
| vasion/virtual_appliance_host | < 22.0.1026 | 22.0.1026 |