GHSA-j23f-57hr-qqcx: FOLIO mod-service-interaction Arbitrary Code Execution via Number Generators

FOLIO is an open source library services platform. Its mod-service-interaction module manages number generator sequences, and the POST /servint/numberGenerators and PUT /servint/numberGenerators/{sequence_id} endpoints store the sequence definition without validating it. The stored value runs as code when anyone calls GET /servint/numberGenerators/getNextNumber for that sequence.

A user with permission to create or edit a number generator plants code that reads the database credentials and gets read and write access to the module's data for every tenant. Where the same credentials serve other modules, the reach extends to them. Fixed in 4.1.3, 4.0.3 and 3.0.5.