From 15609402ef6256f3ff7d91bceace3d7c6505412d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 25 Mar 2024 19:44:17 +0000 Subject: [PATCH] Publish Advisories GHSA-jx4p-m4wm-vvjg GHSA-rf39-3f98-xr7r GHSA-v7px-46v9-5qwp --- .../GHSA-jx4p-m4wm-vvjg.json | 107 ++++++++++++++++ .../GHSA-rf39-3f98-xr7r.json | 107 ++++++++++++++++ .../GHSA-v7px-46v9-5qwp.json | 121 ++++++++++++++++++ 3 files changed, 335 insertions(+) create mode 100644 advisories/github-reviewed/2024/03/GHSA-jx4p-m4wm-vvjg/GHSA-jx4p-m4wm-vvjg.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-rf39-3f98-xr7r/GHSA-rf39-3f98-xr7r.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-v7px-46v9-5qwp/GHSA-v7px-46v9-5qwp.json diff --git a/advisories/github-reviewed/2024/03/GHSA-jx4p-m4wm-vvjg/GHSA-jx4p-m4wm-vvjg.json b/advisories/github-reviewed/2024/03/GHSA-jx4p-m4wm-vvjg/GHSA-jx4p-m4wm-vvjg.json new file mode 100644 index 00000000000..7995b73a15e --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-jx4p-m4wm-vvjg/GHSA-jx4p-m4wm-vvjg.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jx4p-m4wm-vvjg", + "modified": "2024-03-25T19:42:17Z", + "published": "2024-03-25T19:42:17Z", + "aliases": [ + "CVE-2024-29188" + ], + "summary": "Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files", + "details": "### Summary\nThe custom action behind WiX's `RemoveFolderEx` functionality could allow a standard user to delete protected directories.\n\n### Details\n`RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "wix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.14.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "wix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "WixToolset.Util.wixext" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29188" + }, + { + "type": "WEB", + "url": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742" + }, + { + "type": "WEB", + "url": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/wixtoolset/issues" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-59" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:42:17Z", + "nvd_published_at": "2024-03-24T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-rf39-3f98-xr7r/GHSA-rf39-3f98-xr7r.json b/advisories/github-reviewed/2024/03/GHSA-rf39-3f98-xr7r/GHSA-rf39-3f98-xr7r.json new file mode 100644 index 00000000000..4064e47c2bc --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-rf39-3f98-xr7r/GHSA-rf39-3f98-xr7r.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rf39-3f98-xr7r", + "modified": "2024-03-25T19:42:32Z", + "published": "2024-03-25T19:42:32Z", + "aliases": [ + "CVE-2024-29187" + ], + "summary": "WiX based installers are vulnerable to binary hijack when run as SYSTEM", + "details": "### Summary\nBurn uses an unprotected C:\\Windows\\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. \n\n### Details\nWhen a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\\Windows\\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges.\n\nicacls c:\\windows\\temp\n\n **BUILTIN\\Users:(CI)(S,WD,AD,X)** \nBUILTIN\\Administrators:(F)\nBUILTIN\\Administrators:(OI)(CI)(IO)(F)\nNT AUTHORITY\\SYSTEM:(F)\nNT AUTHORITY\\SYSTEM:(OI)(CI)(IO)(F)\n CREATOR OWNER:(OI)(CI)(IO)(F)\n \nBuilt in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel\n \n\n### PoC\n\n PoC works against the against visual studio enterprise with update 3 [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf&P1=1709239640&P2=601&P3=2&P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d&su=1)\n\n#### Reproduction steps\nAs a standard user, run the poc.\nMount the iso and run visual studio installer as local system account.\nThe PoC should hijack the the binaries dropped by vs installer and a child process \"notepad.exe\" will be running.\n\n### Impact\nThis is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\\Windows\\Temp to elevate to the SYSTEM user privileges. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "wix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.14.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "wix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "NuGet", + "name": "WixToolset.Sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29187" + }, + { + "type": "WEB", + "url": "https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7" + }, + { + "type": "WEB", + "url": "https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/wixtoolset/issues" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:42:32Z", + "nvd_published_at": "2024-03-24T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-v7px-46v9-5qwp/GHSA-v7px-46v9-5qwp.json b/advisories/github-reviewed/2024/03/GHSA-v7px-46v9-5qwp/GHSA-v7px-46v9-5qwp.json new file mode 100644 index 00000000000..b2e6df4ff2e --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-v7px-46v9-5qwp/GHSA-v7px-46v9-5qwp.json @@ -0,0 +1,121 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v7px-46v9-5qwp", + "modified": "2024-03-25T19:43:07Z", + "published": "2024-03-25T19:43:06Z", + "aliases": [ + "CVE-2023-48296" + ], + "summary": "Storefront user can access history and most viewed data from matching back-office user with the same ID", + "details": "### Impact\n\nNavigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "oro/customer-portal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "last_affected": "4.1.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "oro/customer-portal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "last_affected": "4.2.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "oro/customer-portal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "last_affected": "5.0.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "oro/customer-portal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "5.1.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.1.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-v7px-46v9-5qwp" + }, + { + "type": "WEB", + "url": "https://github.com/oroinc/orocommerce/commit/41c526498012d44cd88852c63697f1ef53b61db8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/oroinc/orocommerce" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:43:06Z", + "nvd_published_at": null + } +} \ No newline at end of file