OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with opensslpkcs7verify(..., PKCS7NOVERIFY, ...). PKCS7NOVERIFY disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the SERIAL field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (SERIAL = victim device, attacker-chosen UDID) with an arbitrary self-signed certificate; POST it unauthenticated to /api-mdm.php/profile (Content-Type: application/pkcs7-signature); and receive the victim device's freshly minted MDM identity: a certificate with CN=<serial> issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned .mobileconfig enrollment profile. Additionally, the victim's mobiledevice database row is silently overwritten with the attacker-supplied UDID (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (/checkin, /mdm, /parameters), which authenticate callers by the certificate CN (the serial number) via checkSignature() in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to self-service/ajax-handler/job-containers.php pass uninstallpackageassignmentid[] values to lib/SelfService/CoreLogic.class.php::uninstallSelfService(). Its permission-check loop continues after denied METHODDEPLOY checks without removing rejected IDs from $installationIds, then passes the original list to lib/CoreLogic.class.php::uninstall(). The CoreLogic object is constructed with a null SystemUser, causing lib/CoreLogic.class.php::checkPermission() to treat the operation as system context and unconditionally permit it. Enumerable computerpackage.id values allow selection of readable installed-package assignments, including those on other users' computers. The deploySelfService() install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton() in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick handler, using htmlspecialchars(ENTQUOTES) only for HTML escaping. Browsers decode the HTML entities before interpreting the handler as JavaScript, allowing a crafted hostname to escape the string and execute script in an administrator's authenticated session when an affected command button is activated. frontend/views/computer-details.php passes $computer->hostname to this helper using Computer::DEFAULTCOMPUTERCOMMANDS in lib/Models/Computer.class.php, whose VNC, RDP, SSH, and Ping entries use newtab=false and the vulnerable window.location branch. A remote attacker who possesses the shared agent-registration-key can use the oco.agent.hello handler in frontend/api-agent.php to store an unchecked hostname when agent-self-registration-enabled is enabled; self-registration is disabled by default. The vulnerable default command buttons require no custom command configuration. The injected script can abuse the administrator's privileges, including permission to deploy software jobs to managed computers. This issue is fixed in version 1.2.1.