From 47e92a8a1759a52248879a58a21faf3dc9ea926b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 11 Mar 2025 20:32:15 +0000 Subject: [PATCH] Publish Advisories GHSA-26xq-m8xw-6373 GHSA-7j6w-p859-464f GHSA-968p-4wvh-cqc8 --- .../GHSA-26xq-m8xw-6373.json | 67 ++++++ .../GHSA-7j6w-p859-464f.json | 66 ++++++ .../GHSA-968p-4wvh-cqc8.json | 210 ++++++++++++++++++ 3 files changed, 343 insertions(+) create mode 100644 advisories/github-reviewed/2025/03/GHSA-26xq-m8xw-6373/GHSA-26xq-m8xw-6373.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-7j6w-p859-464f/GHSA-7j6w-p859-464f.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-968p-4wvh-cqc8/GHSA-968p-4wvh-cqc8.json diff --git a/advisories/github-reviewed/2025/03/GHSA-26xq-m8xw-6373/GHSA-26xq-m8xw-6373.json b/advisories/github-reviewed/2025/03/GHSA-26xq-m8xw-6373/GHSA-26xq-m8xw-6373.json new file mode 100644 index 00000000000..e04dd31dfbb --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-26xq-m8xw-6373/GHSA-26xq-m8xw-6373.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-26xq-m8xw-6373", + "modified": "2025-03-11T20:31:08Z", + "published": "2025-03-11T20:31:08Z", + "aliases": [], + "summary": "Froxlor has an HTML Injection Vulnerability", + "details": "### Summary\n_An HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by redirecting users to malicious external websites. The vulnerability has a medium severity, as it can be exploited through user input without authentication._\n\n### Observation\n_It is observed that in the portal of the customer account, there is a functionality in the email section to create an email address that accepts user input. By intercepting the request and modifying the \"domain\" field with an HTML injection payload containing an anchor tag, the injected payload is reflected on an error page. When clicked, it redirects users to an external website, confirming the presence of an HTML Injection vulnerability._\n\n### PoC\n1. Navigate to the Email section in the Customer Account Portal and create a new email address.\n\n2. Enter any garbage value in the required field and intercept the request using Burp Suite.\n\n3. Locate the \"domain\" field in the intercepted request and replace its value with the following HTML Injection payload:\n\n\t`CLiCK`\n\n4. Forward the modified request and observe that the injected payload is reflected on an error page.\n\n5. Click on the displayed \"CLiCK\" link to verify that it redirects to `https://www.google.com`, confirming the presence of HTML [Injection.]([url]([froxlor_HTML-INJECTION.mp4.zip](https://github.com/user-attachments/files/18311429/froxlor_HTML-INJECTION.mp4.zip)))\n\n### Impact\n_An attacker can exploit this HTML Injection vulnerability to manipulate the portal’s content, conduct phishing attacks, deface the application, or trick users into clicking malicious links. This can lead to credential theft, malware distribution, reputational damage, and potential compliance violations.\nThe users of the customer account portal are impacted by this vulnerability. Specifically, any user who interacts with the email section of the portal may be tricked into clicking malicious links, leading to potential phishing attacks, credential theft, and exposure to other malicious activities. The organization hosting the portal could also be impacted by reputational damage and compliance violations._\n\n### Recommendation\n_It is recommended to implement proper input validation and output encoding to prevent HTML Injection. The application should sanitize user input by stripping or escaping HTML tags before rendering it on the page._", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.2.5" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/froxlor/Froxlor/security/advisories/GHSA-26xq-m8xw-6373" + }, + { + "type": "WEB", + "url": "https://github.com/froxlor/Froxlor/commit/fde43f80600f1035e1e3d2297411b666d805549a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/froxlor/Froxlor" + }, + { + "type": "WEB", + "url": "https://github.com/user-attachments/assets/86947633-3e7c-4e10-86cc-92e577761e8e" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79", + "CWE-80" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-11T20:31:08Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-7j6w-p859-464f/GHSA-7j6w-p859-464f.json b/advisories/github-reviewed/2025/03/GHSA-7j6w-p859-464f/GHSA-7j6w-p859-464f.json new file mode 100644 index 00000000000..6a1ebb659c8 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-7j6w-p859-464f/GHSA-7j6w-p859-464f.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7j6w-p859-464f", + "modified": "2025-03-11T20:30:50Z", + "published": "2025-03-11T20:30:35Z", + "aliases": [], + "summary": "Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover", + "details": "### Summary\nthe vulnerability is that users (such as resellers or customers) are able to create accounts with the same email address as an existing account (e.g., if the admin has [admin@froxlor.com](mailto:admin@froxlor.com), others can also create an account using the same email). This creates potential issues with account identification and security.\n\n### Impact\nLocal/Authenticated: This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin.\nEmail-based: The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "froxlor/froxlor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.2.5" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/froxlor/Froxlor/security/advisories/GHSA-7j6w-p859-464f" + }, + { + "type": "WEB", + "url": "https://github.com/froxlor/Froxlor/commit/a43d53d54034805e3e404702a01312fa0c40b623" + }, + { + "type": "PACKAGE", + "url": "https://github.com/froxlor/Froxlor" + }, + { + "type": "WEB", + "url": "https://mega.nz/file/h8oFHQrL#I4V02_BWee4CCx7OoBl_2Ufkd5Wc7fvs5aCatGApkoQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-11T20:30:35Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-968p-4wvh-cqc8/GHSA-968p-4wvh-cqc8.json b/advisories/github-reviewed/2025/03/GHSA-968p-4wvh-cqc8/GHSA-968p-4wvh-cqc8.json new file mode 100644 index 00000000000..22122b5ebbf --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-968p-4wvh-cqc8/GHSA-968p-4wvh-cqc8.json @@ -0,0 +1,210 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-968p-4wvh-cqc8", + "modified": "2025-03-11T20:30:18Z", + "published": "2025-03-11T20:30:18Z", + "aliases": [ + "CVE-2025-27789" + ], + "summary": "Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups", + "details": "### Impact\n\nWhen using Babel to compile [regular expression named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group), Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`).\n\nYour generated code is vulnerable if _all_ the following conditions are true:\n- You use Babel to compile [regular expression named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group) or \n- You use the `.replace` method on a regular expression that contains named capturing groups\n- **Your code uses untrusted strings as the second argument of `.replace`**\n\nIf you are using `@babel/preset-env` with the [`targets`](https://babeljs.io/docs/options#targets) option, the transform that injects the vulnerable code is automatically enabled if:\n- you use [_duplicated_ named capturing groups](https://github.com/tc39/proposal-duplicate-named-capturing-groups), and target any browser older than Chrome/Edge 126, Opera 112, Firefox 129, Safari 17.4, or Node.js 23\n- you use any [named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group), and target any browser older than Chrome 64, Opera 71, Edge 79, Firefox 78, Safari 11.1, or Node.js 10\n\nYou can verify what transforms `@babel/preset-env` is using by enabling the [`debug` option](https://babeljs.io/docs/babel-preset-env#debug).\n\n\n### Patches\n\nThis problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17, please upgrade. It's likely that you do not directly depend on `@babel/helpers`, and instead you depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees that you are on a new enough `@babel/helpers` version.\n\nPlease note that just updating your Babel dependencies is not enough: you will also need to re-compile your code.\n\n### Workarounds\n\nIf you are passing user-provided strings as the second argument of `.replace` on regular expressions that contain named capturing groups, validate the input and make sure it does not contain the substring `$<` if it's then not followed by `>` (possibly with other characters in between).\n\n### References\n\nThis vulnerability was reported and fixed in https://github.com/babel/babel/pull/17173.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@babel/helpers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.26.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@babel/runtime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.26.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@babel/runtime-corejs2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.26.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@babel/runtime-corejs3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.26.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@babel/helpers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0-alpha.0" + }, + { + "fixed": "8.0.0-alpha.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 8.0.0-alpha.16" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "@babel/runtime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0-alpha.0" + }, + { + "fixed": "8.0.0-alpha.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 8.0.0-alpha.16" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "@babel/runtime-corejs2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0-alpha.0" + }, + { + "fixed": "8.0.0-alpha.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 8.0.0-alpha.16" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "@babel/runtime-corejs3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0-alpha.0" + }, + { + "fixed": "8.0.0-alpha.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 8.0.0-alpha.16" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8" + }, + { + "type": "WEB", + "url": "https://github.com/babel/babel/pull/17173" + }, + { + "type": "WEB", + "url": "https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/babel/babel" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-11T20:30:18Z", + "nvd_published_at": null + } +} \ No newline at end of file