Typebot v3.18.0 Security Advisory: SSRF, Privilege Escalation, and Auth Fixes

Vulnerability Overview The provided webpage screenshot displays the update logs for Typebot v3.18.0, which include multiple security-related fixes and improvements. These fixes aim to address potential security vulnerabilities, protecting user data and system security. Scope of Impact Custom Domain Deletion Ownership Check: Fixed the ownership check issue when deleting custom domains to prevent unauthorized deletions. Enhanced Email Login Code: Strengthened email login security to prevent brute-force attacks and unauthorized access. Secure Email Attachment Handling: Improved the handling of email attachments to prevent security risks associated with malicious attachments. Deprecation of Insecure File Upload URLs: Deprecated insecure file upload URLs to prevent file upload vulnerabilities. Upgrade of Vulnerable Dependencies: Updated dependencies with known vulnerabilities to reduce the risk of exploitation. Fix for TAC Scanner Header Discovery: Fixed issues with the TAC scanner header to prevent information leakage. Prevention of Guest Invitation Email Abuse: Prevented abuse of guest invitation emails to protect user privacy. Fix for Preview Workspace Credentials Binding: Fixed issues with preview workspace credentials binding to prevent credential leakage. Prevention of Cross-Workspace Invitation Takeover: Prevented takeover attacks on cross-workspace invitations to protect workspace security. Prevention of Webhook Credential Leakage in Logs: Prevented the leakage of webhook credentials in logs to protect sensitive information. Protection of Typebot Collaborator Identities: Protected Typebot collaborator identity information to prevent identity theft. Sanitization of Embed Bubble URLs: Sanitized URLs in embed bubbles to prevent malicious links. Protection of AI Provider Base URL Against SSRF Attacks: Prevented Server-Side Request Forgery (SSRF) attacks to protect AI provider security. Secure Server-Side HTTP Request Execution: Enhanced the security of server-side HTTP requests to prevent malicious requests. Fix for Free Workspace Creation Race Condition: Fixed race conditions during free workspace creation to prevent unauthorized creation. Secure HTTP Proxy Destination: Protected HTTP proxy destination addresses to prevent Man-in-the-Middle (MitM) attacks. Protection of Dify Endpoint Against SSRF Attacks: Prevented SSRF attacks on the Dify endpoint to protect system security. Prevention of Workspace Session Limit Race Condition: Fixed race conditions in workspace session limits to prevent unauthorized access. Protection of Nozbe and PostHog Requests Against SSRF Attacks: Prevented SSRF attacks on Nozbe and PostHog requests to protect system security. Restriction of Guest Access to Collaborative Typebots: Restricted guest access to collaborative Typebots to protect the security of collaborative content. Remediation Custom Domain Deletion Ownership Check: Ensure strict ownership verification is performed when deleting custom domains. Enhanced Email Login Code: Implement login attempt rate limiting and enforce stronger password policies. Secure Email Attachment Handling: Perform virus scanning and type validation on attachments to prevent malicious attachments. Deprecation of Insecure File Upload URLs: Deprecate insecure file upload URLs and adopt more secure upload mechanisms. Upgrade of Vulnerable Dependencies: Regularly update dependencies to patch known vulnerabilities. Fix for TAC Scanner Header Discovery: Resolve issues with the TAC scanner header to prevent information leakage. Prevention of Guest Invitation Email Abuse: Limit the frequency and quantity of guest invitations to prevent abuse. Fix for Preview Workspace Credentials Binding: Ensure correct binding of preview workspace credentials to prevent leakage. Prevention of Cross-Workspace Invitation Takeover: Implement additional verification mechanisms for cross-workspace invitations to prevent takeover attacks. Prevention of Webhook Credential Leakage in Logs: Mask webhook credentials in logs to prevent leakage. Protection of Typebot Collaborator Identities: Encrypt collaborator identity information at rest to prevent theft. Sanitization of Embed Bubble URLs: Filter and validate URLs in embed bubbles to prevent malicious links. Protection of AI Provider Base URL Against SSRF Attacks: Validate base URLs for AI providers to prevent SSRF attacks. Secure Server-Side HTTP Request Execution: Validate and filter server-side HTTP requests to prevent malicious requests. Fix for Free Workspace Creation Race Condition: Implement verification mechanisms during workspace creation to prevent unauthorized creation. Secure HTTP Proxy Destination: Validate HTTP proxy destination addresses to prevent Man-in-the-Middle (MitM) attacks. Protection of Dify Endpoint Against SSRF Attacks: Validate the Dify endpoint to prevent SSRF attacks. Prevention of Workspace Session Limit Race Condition: Implement verification mechanisms for session limits to prevent unauthorized acc

Goal Reached Thanks to every supporter — we hit 100%!

Typebot v3.18.0 Security Advisory: SSRF, Privilege Escalation, and Auth Fixes

More from this source