diff --git a/advisories/unreviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json b/advisories/github-reviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json similarity index 64% rename from advisories/unreviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json rename to advisories/github-reviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json index dbde8ea0e2a..224c9c74363 100644 --- a/advisories/unreviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json +++ b/advisories/github-reviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rpx8-fg6w-rm6x", - "modified": "2024-06-06T21:30:37Z", + "modified": "2024-07-19T19:59:18Z", "published": "2024-06-06T21:30:37Z", "aliases": [ "CVE-2024-5478" ], + "summary": "lunary-ai/lunary XSS in SAML metadata endpoint", "details": "A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadata` of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the `orgId` parameter supplied by the user before incorporating it into the generated response. Specifically, the endpoint generates XML responses for SAML metadata, where the `orgId` parameter is directly embedded into the XML structure without proper sanitization or validation. This flaw allows an attacker to inject arbitrary JavaScript code into the generated SAML metadata page, leading to potential theft of user cookies or authentication tokens.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "lunary" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.2.7" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5478" }, + { + "type": "PACKAGE", + "url": "https://github.com/lunary-ai/lunary" + }, + { + "type": "WEB", + "url": "https://github.com/lunary-ai/lunary/blob/main/packages/backend/src/api/v1/auth/saml.ts#L34" + }, { "type": "WEB", "url": "https://huntr.com/bounties/e899f496-d493-4c06-b596-cb0a88ad451b" @@ -31,8 +58,8 @@ "CWE-79" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:18Z", "nvd_published_at": "2024-06-06T19:16:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json b/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json new file mode 100644 index 00000000000..3e3c4071604 --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wf2-2pq4-4rvc", + "modified": "2024-07-19T19:59:06Z", + "published": "2024-07-19T19:59:06Z", + "aliases": [ + "CVE-2024-41122" + ], + "summary": "Woodpecker's custom environment variables allow to alter execution flow of plugins", + "details": "### Impact\nThe server allow to create any user who can trigger a pipeline run malicious workflows:\n- Those workflows can either lead to a host takeover that runs the agent executing the workflow.\n- Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.\n\n### Patches\nhttps://github.com/woodpecker-ci/woodpecker/pull/3909\nhttps://github.com/woodpecker-ci/woodpecker/pull/3934\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n**Enable the \"gated\" repo feature and review each change upfront of running**\n\n### References\n- https://github.com/woodpecker-ci/woodpecker/pull/3909\n- https://github.com/woodpecker-ci/woodpecker/pull/3934\n- https://github.com/woodpecker-ci/woodpecker-security/issues/10 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3929)\n- https://github.com/woodpecker-ci/woodpecker/issues/3929 (info will be published later once we got adoption of the update)\n\n### Credits\n\n- Daniel Kilimnik [@D_K_Dev](https://x.com/D_K_Dev) (Neodyme AG)\n- Felipe Custodio Romero [@_localo_](https://x.com/_localo_) (Neodyme AG)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/issues/3929" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/pull/3909" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/pull/3934" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/commit/8aa3e5ec82c92eca3279e4be68625111eeedf1c4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/woodpecker-ci/woodpecker" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:06Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-rwcj-7jjp-4w38/GHSA-rwcj-7jjp-4w38.json b/advisories/github-reviewed/2024/07/GHSA-rwcj-7jjp-4w38/GHSA-rwcj-7jjp-4w38.json new file mode 100644 index 00000000000..1770db7f5bc --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-rwcj-7jjp-4w38/GHSA-rwcj-7jjp-4w38.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rwcj-7jjp-4w38", + "modified": "2024-07-19T19:59:14Z", + "published": "2024-07-19T19:59:14Z", + "aliases": [ + "CVE-2024-41124" + ], + "summary": "[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`", + "details": "### Impact\n`API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks.\n\n### References\n[ISSUE](https://github.com/ARPSyndicate/puncia/issues/8)\n[PATCH](https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "puncia" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.21" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38" + }, + { + "type": "WEB", + "url": "https://github.com/ARPSyndicate/puncia/issues/8" + }, + { + "type": "WEB", + "url": "https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ARPSyndicate/puncia" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-319" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:14Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-xw35-rrcp-g7xm/GHSA-xw35-rrcp-g7xm.json b/advisories/github-reviewed/2024/07/GHSA-xw35-rrcp-g7xm/GHSA-xw35-rrcp-g7xm.json new file mode 100644 index 00000000000..15aab711815 --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-xw35-rrcp-g7xm/GHSA-xw35-rrcp-g7xm.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xw35-rrcp-g7xm", + "modified": "2024-07-19T19:59:08Z", + "published": "2024-07-19T19:59:08Z", + "aliases": [ + "CVE-2024-41121" + ], + "summary": "Woodpecker's custom workspace allow to overwrite plugin entrypoint executable", + "details": "### Impact\nThe server allow to create any user who can trigger a pipeline run malicious workflows:\n- Those workflows can either lead to a host takeover that runs the agent executing the workflow.\n- Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.\n\n### Patches\nhttps://github.com/woodpecker-ci/woodpecker/pull/3933\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n**Enable the \"gated\" repo feature and review each change upfront**\n\n### References\n- https://github.com/woodpecker-ci/woodpecker/pull/3933\n- https://github.com/woodpecker-ci/woodpecker-security/pull/11\n- https://github.com/woodpecker-ci/woodpecker-security/issues/8 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924)\n- https://github.com/woodpecker-ci/woodpecker-security/issues/9 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924)\n- https://github.com/woodpecker-ci/woodpecker/issues/3924 (info will be published later once we got adoption of the update)\n\n### Credits\n\n- Daniel Kilimnik [@D_K_Dev](https://x.com/D_K_Dev) (Neodyme AG)\n- Felipe Custodio Romero [@_localo_](https://x.com/_localo_) (Neodyme AG)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-xw35-rrcp-g7xm" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/issues/3924" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/pull/3933" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/commit/764329ed1dbc47c4a517ccc749e3feb34059fac8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/woodpecker-ci/woodpecker" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:08Z", + "nvd_published_at": null + } +} \ No newline at end of file