diff --git a/advisories/github-reviewed/2022/05/GHSA-6xc7-4cx8-j3xc/GHSA-6xc7-4cx8-j3xc.json b/advisories/github-reviewed/2022/05/GHSA-6xc7-4cx8-j3xc/GHSA-6xc7-4cx8-j3xc.json index 02562028082..dff00aea97a 100644 --- a/advisories/github-reviewed/2022/05/GHSA-6xc7-4cx8-j3xc/GHSA-6xc7-4cx8-j3xc.json +++ b/advisories/github-reviewed/2022/05/GHSA-6xc7-4cx8-j3xc/GHSA-6xc7-4cx8-j3xc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6xc7-4cx8-j3xc", - "modified": "2024-04-29T14:25:02Z", + "modified": "2024-10-07T16:00:20Z", "published": "2022-05-13T01:46:20Z", "aliases": [ "CVE-2017-5936" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ @@ -52,6 +56,10 @@ "type": "PACKAGE", "url": "https://github.com/openstack/nova-lxd" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nova-lxd/PYSEC-2017-21.yaml" + }, { "type": "WEB", "url": "https://web.archive.org/web/20200227193915/http://www.securityfocus.com/bid/96182" diff --git a/advisories/github-reviewed/2024/10/GHSA-6hwr-6v2f-3m88/GHSA-6hwr-6v2f-3m88.json b/advisories/github-reviewed/2024/10/GHSA-6hwr-6v2f-3m88/GHSA-6hwr-6v2f-3m88.json new file mode 100644 index 00000000000..cb00b58d64e --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-6hwr-6v2f-3m88/GHSA-6hwr-6v2f-3m88.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hwr-6v2f-3m88", + "modified": "2024-10-07T15:58:52Z", + "published": "2024-10-07T15:58:52Z", + "aliases": [ + "CVE-2024-45293" + ], + "summary": "XXE in PHPSpreadsheet's XLSX reader", + "details": "### Summary\nThe security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. \n\n### Details\nThe security scan function in `src/PhpSpreadsheet/Reader/Security/XmlScanner.php` contains a flawed XML encoding check to retrieve the input file's XML encoding in the `toUtf8` function. \n\nThe function searches for the XML encoding through a defined regex which looks for `encoding=\"*\"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. \n\n ```\n$patterns = [\n '/encoding=\"([^\"]*]?)\"/',\n \"/encoding='([^']*?)'/\",\n];\n```\n\nThis logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the `=` in the attribute definition. \n\n### PoC\n\nNeeded:\n- An Excel sheet (XLSX) with at least one cell containing a value.\n\nUnzip the excel sheet, and modify the `xl/SharedStrings.xml` file with the following value (note the space after `encoding=`):\n\n```\n\n+ADw-!DOCTYPE abc [ ... ]>\n```\n\n#### Step-by-step\n\n1. First off, the following string is encoded in base64:\n\n```\n\" \n```\n\nResulting in:\n\n```\nPCFFTlRJVFkgaW50ZXJuYWwgJ2FiYycgID4K\n```\n\n2. The string is used with a parameter entity and the PHP filter wrapper to ultimately define custom entities and call them within the XML.\n\n```\n\n+ADw-!DOCTYPE foo [ %xxe;]>\n&internal;\n```\n\nWhen this file is parsed by the library, the value `abc` should be in the original filled cell.\n\nWith the help of the PHP filter wrapper, this can be escalated to information disclosure/file read. \n\n### Impact\nSensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.0" + }, + { + "fixed": "2.3.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.29.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6hwr-6v2f-3m88" + }, + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/3bcd51826b7f089d1641e756c83030c30c3bdb0c" + }, + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/7d6cb09f6e8204f65e6dd5a0490f7f45f44bb331" + }, + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/commit/949ff63e1f6413e6485f73af012d506aa81384bf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PHPOffice/PhpSpreadsheet" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-07T15:58:52Z", + "nvd_published_at": null + } +} \ No newline at end of file