Zoo Text-to-CAD Platform

Findings · 13

1. 1 SAML ancestor marking allows unsigned content to survive signature reduction Low
2. 2 Logic error in get_signed_node returns ds:Object content instead of Reference URI target Low
3. 3 XPointer URI resolution discrepancy could enable signature bypass Low
4. 4 XPath transform discrepancy could allow unsigned content to be treated as signed Low
5. 5 Pull request preview environments can be accessed by anyone via the user-controlled pr parameter Low
6. 6 Account linking based on OIDC email claims could enable account takeover Low
7. 7 The text-to-CAD service can be invoked by any internal service due to a lack of authentication and network isolation Medium
8. 8 The auth_via_websocket panics when too many headers are sent Informational
9. 9 Hard-coded secret in STUNner Kubernetes manifest Medium
10. 10 WebSocket billing bypass vulnerability via URL encoding in path detection Medium
11. 11 URL-encoded path traversal vulnerability in documentation fetching Informational
12. 12 URL-encoded path traversal vulnerability in sample file fetching Informational
13. 13 Arbitrary file write vulnerability in the /file/conversion API endpoint via absolute path in multipart filename High

Findings extracted from the published report PDF. See the full report below for details and remediation.