TREK v3.3.0 Security Advisory: Fix for IDOR, SSRF, LPE, and Plugin Hardening

TREK v3.3.0 Security Vulnerability Patch Summary Vulnerability Overview This update addresses multiple security vulnerabilities, primarily involving access control, SSRF (Server-Side Request Forgery), privilege escalation, and information disclosure issues. Affected Scope Affected Versions: v3.2.0 and earlier Fixed Version: v3.3.0 Remediation Steps 1. Access Control Defect (IDOR) Vulnerability Description: An IDOR (Insecure Direct Object Reference) vulnerability allows users to delete other users' files by iterating through IDs. Remediation: Fixed the file deletion logic to ensure users can only delete files they own. Related Issue: 2. SSRF Vulnerability (Server-Side Request Forgery) Vulnerability Description: Users can configure the LLM base URL, allowing attackers to initiate requests pointing to internal networks or cloud metadata addresses (e.g., ). Remediation: Blocked the resolution of URLs pointing to internal network/cloud metadata address ranges. Redirected requests are now manually re-validated. Added the tool within the OAuth scope to return trip summaries (including email addresses), while restricting the exposure of sensitive data. Related Issue: 3. Privilege Escalation Vulnerability Vulnerability Description: Public itinerary sharing was ignored, allowing anyone who knows the ID to view the itinerary. Remediation: Enforced server-side checks to ensure only the itinerary owner can view the itinerary. Added warnings in the UI and applied the same checks to itinerary photo/asset sharing and shared location photo proxies. Related Issue: 4. Plugin Security Hardening Vulnerability Description: Plugins were potentially susceptible to host hijacking, data leakage, or privilege abuse. Remediation: Operator-supplied egress hosts: Hosts allowed by plugins are now pinned at release time to prevent abuse of self-hosted services. Per-plugin RPC rate limit: Implemented token bucket limits to prevent resource abuse. Plain-HTTP egress: Blocked plaintext HTTP requests to hosts that are not explicitly configured. Lifecycle hardening: Enhanced plugin lifecycle management, including crash recovery and cleanup. Uninstall purges: Completely removed plugin keys and configurations upon uninstallation. Bridge path hardening: Prevented path traversal attacks. Non-visible plugin activity log: Logged plugin activities for audit purposes. Backup now includes: Backups now include plugin data to prevent data loss. Lifecycle races: Fixed race conditions in the lifecycle. SDK mock host: Ensured the SDK mock host environment matches the production environment. 5. Other Security Fixes MCP Connection: Fixed an issue where MCP connections would disconnect during OAuth access token refresh. Related Issue:

Goal Reached Thanks to every supporter — we hit 100%!

TREK v3.3.0 Security Advisory: Fix for IDOR, SSRF, LPE, and Plugin Hardening

More from this source