government public service

education learning

news/blog

Italian

unicms_external_sources_consent

unicms_sessionid

_pk_id.bm93LeJpxR.dfa0

_pk_ses.bm93LeJpxR.dfa0

The domain name 'www.unical.it' uses the Italian country-code top-level domain (.it), featuring subdomain 'www'. Its registrable label 'unical' stretches across 6 characters containing 3 vowels alongside three consonants. Segmentation suggests 2 words: un, ical. The median word length lands at three characters. No strong language cues emerged from the frequency lists.

default-src *.webanalytics.italia.it data: 'unsafe-eval' 'unsafe-inline'; object-src 'none';  upgrade-insecure-requests, frame-ancestors https://webanalytics.italia.it

application/x-www-form-urlencoded; charset=utf-8

default-src *.webanalytics.italia.it data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; upgrade-insecure-requests, frame-ancestors https://webanalytics.italia.it

b970011ae8240130328dc36f0344143335dad5826cedb12526dd847979b8569c

cca98387e18456f3f13c5162dccce960ed7f66c2e0789d6c152cf6a12bc11ba6

a2bef6c17d13c7b39f5f6be3067f505c494c8ce2e0c672653d2ce64b616a6a09

09dad6652ec7c84463bae5f80159c3f28f330fa5ff4fe4d0675685e2aeac9cb7

6afef34bec87fbfd7dcb55b62938dd145bb47d3fac733eb53975bc2924b1f8f3

5a88ac53eda040a08cc0967f46de0e64400aa9b34457a070e8d1fb1976df5e27

159b16ec7d95e57f531a29d28e3c18278d7d5e46b6ec8f173c3996af21a55adc

73140145b4934bb0aa68415ede7db91248c5bbfd35788039ed5698a778e23be6

677a0c499a5dce4e4f01ed12affb3e5a292c3b94068bb4ca9c8384444a505a07

33d9d8376f4ffed9782044b2e098fec610f355a185a372f4acf6442a9105598c

5a07c69f9061eb12e39a031358a4f567f30a002ad6182639ac84fd1bda2f6e65

5cbda29ea5096ac9404c59c77493a2f467d0eb4a27f16c750b61fc0d888dd716

d7fc375178c93a2fc15fd888e30170eedf4ef3d04497e7f951ab7bfe0c921693

## Summary

When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

# Denial of Service via **proto** Key in mergeConfig

### Summary

The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.

### Details

The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:

```javascript
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
```

When `prop` is `'__proto__'`:

1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property
2. `Object.keys()` includes `'__proto__'` in the iteration
3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)
4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype`
5. `Object.prototype(...)` throws `TypeError: merge is not a function`

The `mergeConfig` function is called by:

- `Axios._request()` at `lib/core/Axios.js:75`
- `Axios.getUri()` at `lib/core/Axios.js:201`
- All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`

### PoC

```javascript
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);
```

**Reproduction steps:**

1. Clone axios repository or `npm install axios`
2. Create file `poc.mjs` with the code above
3. Run: `node poc.mjs`
4. Observe the TypeError crash

**Verified output (axios 1.13.4):**

```
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
```

**Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |

**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.

### Impact

**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

- Node.js servers using axios for HTTP requests
- Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

4d480acd7e9030124d9a492b3ce14d4e35bac0d1e6f152b47d5f4e1c5d05bd9d

0403b7220f884bac2261e52152df0c8aab57d66fd863b5d39563ce854a7c6b4a

0879229be72bb342f57b41a8ef0263f0c4c2bdfb5729991b51c7621ad4aeb67e

a6cd96a295ab0eaf07b683bbd5d77c7da4dd9d67e706066e358e307c64e270fc

b00efb9478b9a7829b4224424c28763b607f92ddf61bff5982b13f0413eb063e

eefe153c97578b47b7fc3a8157f1f2c433b1d4a1576394d7a15bf94538777d04

e510b84eddf30412f0b1f888315151a9a40a728db740ee326dac6878fc57633a

8d0cc9c2b989e194de0e4f6ce45f934ffc224c0c53214f23aaa212f03077483b

7ea34cd0a5cdd5350a6c9c97cf6c70aa457878c7605457393aa551710c360621

c5c98a3776fffa74aace08f7b9a8e1a75f00f8ea646b6bc865abfba14bcddbb9

e1726b1b15289ddbc313a258b0079c0096caf91026113a19b41a9881f122ba3a

91512c3361044c271da301330ff669990e27d29d885b85b618817747f83771ee

63a63b3e3555c4940ec17e0f82eda262b8a28db303bb0e63edb45a49274d4f72

width=device-width, initial-scale=1, shrink-to-fit=no

viewport

Il Campus per eccellenza che cresce con il territorio ed è capace di creare prospettive di crescita culturale, sociale ed economica per i propri studenti.

description

keywords

robots

es6qhL8EssZAS16YTU6bKA8xjqWkCJEaLv0cMKyoFV8

google-site-verification

https://www.unical.it/static/images/logo.png

twitter:card

twitter:title

twitter:description

twitter:image

twitter:image:alt

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

unical.it

Abuse Account

Fastly RIR Administrator

Fastly Network Operations

Fastly, Inc.

SKYCA-3

window.__PUBLIC_PATH__ = "https://cdn.jsdelivr.net/npm/bootstrap-italia@2.15.0/dist/fonts"


  var _paq = window._paq = window._paq || [];
  /* tracker methods like "setCustomDimension" should be called before "trackPageView" */
  _paq.push(['trackPageView']);
  _paq.push(['enableLinkTracking']);
  (function() {
    var u="https://ingestion.webanalytics.italia.it/";
    _paq.push(['setTrackerUrl', u+'matomo.php']);
    _paq.push(['setSiteId', 'bm93LeJpxR']);
    var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
    g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
  })();



var id_964 = new Vue({
    el: '#id_964',
    data() {
        return {
            has_consent: hasConsent("https://www.youtube-nocookie.com/embed/CF3kOjPaICI"),
            host: normalizeHost("https://www.youtube-nocookie.com/embed/CF3kOjPaICI"),
            permanent: false
        }
    },
    mounted() {
        editConsent(host=this.host, revoke=false, explicit=false)
    },
    methods: {
        addConsent() {
            this.has_consent = true
            if(this.permanent) editConsent(host=this.host)
        },
    }
})



function changeVideo(source){
document.getElementById("video_iframe").src = 'https://www.youtube-nocookie.com/embed/' + source;
}



//Vue.use(VueMarkdown);
var id_7910 = new Vue({
    el: '#id_7910',
    data() {
        return {
            url: "https://www.youtube-nocookie.com/embed/A2Ah_IPjFWQ",
            has_consent: false,
            host: "",
            permanent: false
        }
    },
    mounted() {
        this.host = normalizeHost(this.url),
        this.has_consent = hasConsent(normalizeHost(this.url))
        editConsent(host=this.url, revoke=false, explicit=false)
    },
    methods: {
        addConsent() {
            this.has_consent = true
            if(this.permanent) editConsent(host=this.host)
        },
    }
})



Vue.component('events-pagination', {
    props: {
        data: Array,
        id: String
    },
    template: `
    <div class="text-center">
    <div class="row">
        <div class="col">
            <span style="color:#050b12;">
                <b>[[ data.count || 0]] risultati</b> in <b>[[ data.total_pages || 0 ]] pagine</b>
            </span>
        </div>
    </div>
    <div class="row">
        <div class="col" v-if="data.total_pages > 1">
            <div>
                <span :onclick="'id_6919.getEvents(id_6919.previous_page)'" style="cursor: pointer">
                    <span class="visually-hidden"> pagina </span> &lt;
                </span>

                <span class="ms-2 me-2" >[[ data.page ]] / <b>[[ data.total_pages ]]</b></span>

                <span :onclick="'id_6919.getEvents(id_6919.next_page)'" style="cursor: pointer">
                    <span class="visually-hidden"> pagina </span> &gt;
                </span>
            </div>
        </div>
    </div>
    <hr>
    </div>
    `
});


var id_6919 = new Vue({
    el: '#id_6919',
    data () {
        return {
            url: '/api/calendars/by-context/1/future-events/?lang=it&page_size=3',
            items: [],
            next_page: "",
            previous_page: "",
        }
    },
    mounted() {
        this.getEvents(this.url);
    },
    methods: {
        getEvents(url){
            axios
                .get(url)
                .then(response => {
                    this.items = response.data
                    this.next_page = response.data.next;
                    this.previous_page = response.data.previous;
                })
        },

    }
})



var id_9337 = new Vue({
    el: '#id_9337',
    data() {
        return {
            alert_show: false,
            alert_timer: null,
            alert_host: null,
            consents: getConsents(),
            known_sources: ['google.com', 'youtube.com', 'youtube-nocookie.com'],
        }
    },
    methods: {
        changeConsent(host) {
            editConsent(
                host=host,
                revoke=hasConsent(host)
            )
            this.alert_show = true
            this.alert_host = host
            if (this.alert_timer) {
              clearTimeout(this.alert_timer)
            }
            this.alert_timer = setTimeout(
                () => {
                    this.alert_show = false
                    this.alert_timer = null
                    this.alert_host = null
                }, 3000
            );
        }
    }
})



            bootstrap.loadFonts('/bootstrap-italia/dist/fonts');
        

Requests	IP Address	Location	AS Autonomous System
34	160.97.4.68	Rende, Calabria, Italy	AS137Consortium GARR
32	104.17.25.14	United States	AS13335Cloudflare, Inc.
32	151.101.129.229	United States	AS54113Fastly, Inc.
98	3	-	-

Security Scan Report: www.unical.it

Summary

AI Security Verdict

Safe Website

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History