From 37755301fd4705004bc444dbe2b1905598bd762c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 25 Mar 2024 19:36:15 +0000 Subject: [PATCH] Publish Advisories GHSA-8ppr-www8-hfjx GHSA-mmh6-5cpf-2c72 GHSA-wq88-fq4x-h2pm GHSA-8ppr-www8-hfjx --- .../GHSA-8ppr-www8-hfjx.json | 70 +++++++++++++++++++ .../GHSA-mmh6-5cpf-2c72.json | 60 ++++++++++++++++ .../GHSA-wq88-fq4x-h2pm.json | 64 +++++++++++++++++ .../GHSA-8ppr-www8-hfjx.json | 39 ----------- 4 files changed, 194 insertions(+), 39 deletions(-) create mode 100644 advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-mmh6-5cpf-2c72/GHSA-mmh6-5cpf-2c72.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-wq88-fq4x-h2pm/GHSA-wq88-fq4x-h2pm.json delete mode 100644 advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json diff --git a/advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json b/advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json new file mode 100644 index 00000000000..a75de985dc3 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8ppr-www8-hfjx", + "modified": "2024-03-25T19:34:46Z", + "published": "2024-03-25T15:30:41Z", + "aliases": [ + "CVE-2024-29650" + ], + "summary": "@thi.ng/paths Prototype Pollution vulnerability", + "details": "An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the `mutIn` and `mutInManyUnsafe` components.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@thi.ng/paths" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.1.63" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29650" + }, + { + "type": "WEB", + "url": "https://github.com/thi-ng/umbrella/issues/445" + }, + { + "type": "WEB", + "url": "https://github.com/thi-ng/umbrella/commit/c78b484882ad5214a46ef83ddb8020571c171353" + }, + { + "type": "WEB", + "url": "https://gist.github.com/tariqhawis/1bc340ca5ea6ae115c9ab9665cfd5921" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thi-ng/umbrella" + }, + { + "type": "WEB", + "url": "https://learn.snyk.io/lesson/prototype-pollution/#a0a863a5-fd3a-539f-e1ed-a0769f6c6e3b" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:34:46Z", + "nvd_published_at": "2024-03-25T15:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-mmh6-5cpf-2c72/GHSA-mmh6-5cpf-2c72.json b/advisories/github-reviewed/2024/03/GHSA-mmh6-5cpf-2c72/GHSA-mmh6-5cpf-2c72.json new file mode 100644 index 00000000000..24982e4e884 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-mmh6-5cpf-2c72/GHSA-mmh6-5cpf-2c72.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mmh6-5cpf-2c72", + "modified": "2024-03-25T19:35:09Z", + "published": "2024-03-25T19:35:09Z", + "aliases": [ + "CVE-2024-29196" + ], + "summary": "phpMyFAQ Path Traversal in Attachments", + "details": "### Summary\nThere is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root.\n\n### PoC\n1. In settings, the attachment location is vulnerable to path traversal and can be set to e.g ..\\hacked\n![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/6167ba74-254c-4aed-9c16-759e5ceafd81)\n\n2. When the above is set, attachments files are now uploaded to e.g C:\\Apps\\XAMPP\\htdocs\\hacked instead of C:\\Apps\\XAMPP\\htdocs\\phpmyfaq\\attachments\n\n3. Verify this by uploading an attachment and see that the \"hacked\" directory is now created in the web root folder with the attachment file inside.\n![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/325df0cc-e9ee-48bd-a7bb-1295199b4d9e)\n![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/beb10a6a-9d56-4607-8da6-49581991b1fe)\n\n### Impact\nAttackers can potentially upload malicious files outside the specified directory.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyfaq/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2.5" + }, + { + "fixed": "3.2.6" + } + ] + } + ], + "versions": [ + "3.2.5" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mmh6-5cpf-2c72" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thorsten/phpMyFAQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:35:09Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-wq88-fq4x-h2pm/GHSA-wq88-fq4x-h2pm.json b/advisories/github-reviewed/2024/03/GHSA-wq88-fq4x-h2pm/GHSA-wq88-fq4x-h2pm.json new file mode 100644 index 00000000000..954b42ee944 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-wq88-fq4x-h2pm/GHSA-wq88-fq4x-h2pm.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wq88-fq4x-h2pm", + "modified": "2024-03-25T19:35:53Z", + "published": "2024-03-25T19:35:53Z", + "aliases": [ + + ], + "summary": "WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM", + "details": "# Summary\n\nBurn uses an unprotected C:\\Windows\\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users.\n\n# Details\n\nWhen a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\\Windows\\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges.\n\n```\nicacls c:\\windows\\temp\n\nBUILTIN\\Users:(CI)(S,WD,AD,X)\nBUILTIN\\Administrators:(F)\nBUILTIN\\Administrators:(OI)(CI)(IO)(F)\nNT AUTHORITY\\SYSTEM:(F)\nNT AUTHORITY\\SYSTEM:(OI)(CI)(IO)(F)\nCREATOR OWNER:(OI)(CI)(IO)(F)\n```\n\nBuilt in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel\n \n# PoC\n\nPoC works against the against visual studio enterprise with update 3 installer\n\n## Reproduction steps\n\nAs a standard user, run the poc.\nMount the iso and run visual studio [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf&P1=1709239640&P2=601&P3=2&P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d&su=1)as local system account.\nThe PoC should hijack the the binaries dropped by vs installer and a child process \"notepad.exe\" will be running.\n\n# Impact\n\nThis is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\\Windows\\Temp to elevate to the SYSTEM user privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "PanelSW.Custom.WiX" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.15.0-a46" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.15.0-a45" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nirbar/wix3/security/advisories/GHSA-wq88-fq4x-h2pm" + }, + { + "type": "WEB", + "url": "https://github.com/nirbar/wix3/commit/99e754bbc717c61f18862aefd98c035f5e2f848d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nirbar/wix3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:35:53Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json b/advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json deleted file mode 100644 index ae33bfbce72..00000000000 --- a/advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8ppr-www8-hfjx", - "modified": "2024-03-25T15:30:41Z", - "published": "2024-03-25T15:30:41Z", - "aliases": [ - "CVE-2024-29650" - ], - "details": "An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29650" - }, - { - "type": "WEB", - "url": "https://gist.github.com/tariqhawis/1bc340ca5ea6ae115c9ab9665cfd5921" - }, - { - "type": "WEB", - "url": "https://learn.snyk.io/lesson/prototype-pollution/#a0a863a5-fd3a-539f-e1ed-a0769f6c6e3b" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-03-25T15:15:52Z" - } -} \ No newline at end of file