From 4b12ec3b5b133faa894a6fe60294dc1364239154 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 25 Mar 2024 19:40:19 +0000 Subject: [PATCH] Publish Advisories GHSA-3wc5-fcw2-2329 GHSA-64fm-8hw2-v72w GHSA-cvr6-37gx-v8wc GHSA-f98w-7cxr-ff2h GHSA-vxq2-p937-3px3 --- .../GHSA-3wc5-fcw2-2329.json | 61 +++++++++++ .../GHSA-64fm-8hw2-v72w.json | 61 +++++++++++ .../GHSA-cvr6-37gx-v8wc.json | 61 +++++++++++ .../GHSA-f98w-7cxr-ff2h.json | 61 +++++++++++ .../GHSA-vxq2-p937-3px3.json | 102 ++++++++++++++++++ 5 files changed, 346 insertions(+) create mode 100644 advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-vxq2-p937-3px3/GHSA-vxq2-p937-3px3.json diff --git a/advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json b/advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json new file mode 100644 index 00000000000..43a42af0056 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wc5-fcw2-2329", + "modified": "2024-03-25T19:38:37Z", + "published": "2024-03-25T19:38:37Z", + "aliases": [ + "CVE-2024-28246" + ], + "summary": "KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols", + "details": "### Impact\n\nCode that uses KaTeX's `trust` option, specifically that provides a function to block-list certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate `javascript:` links in the output, even if the `trust` function tries to forbid this protocol via `trust: (context) => context.protocol !== 'javascript'`.\n\n### Patches\nUpgrade to KaTeX v0.16.10 to remove this vulnerability.\n\n### Workarounds\n* Allow-list instead of block protocols in your `trust` function.\n* Manually lowercase `context.protocol` via `context.protocol.toLowerCase()` before attempting to check for certain protocols.\n* Avoid use of or turn off the `trust` option.\n\n\n### Details\nKaTeX did not normalize the `protocol` entry of the `context` object provided to a user-specified `trust`-function, so it could be a mix of lowercase and/or uppercase letters.\n\nIt is generally better to allow-list by protocol, in which case this would normally not be an issue. But in some cases, you might want to block-list, and the [KaTeX documentation](https://katex.org/docs/options.html) even provides such an example:\n\n> Allow all commands but forbid specific protocol: `trust: (context) => context.protocol !== 'file'`\n\nCurrently KaTeX internally sees `file:` and `File:` URLs as different protocols, so `context.protocol` can be `file` or `File`, so the above check does not suffice. A simple workaround would be:\n\n> `trust: (context) => context.protocol.toLowerCase() !== 'file'`\n\nMost URL parsers normalize the scheme to lowercase. For example, [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986#section-3.1) says:\n\n> Although schemes are case-insensitive, the canonical form is lowercase and documents that specify schemes must do so with lowercase letters. An implementation should accept uppercase letters as equivalent to lowercase in scheme names (e.g., allow \"HTTP\" as well as \"http\") for the sake of robustness but should only produce lowercase scheme names for consistency.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "katex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.11.0" + }, + { + "fixed": "0.16.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329" + }, + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de" + }, + { + "type": "PACKAGE", + "url": "https://github.com/KaTeX/KaTeX" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-184" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:38:37Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json b/advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json new file mode 100644 index 00000000000..1389fa59597 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-64fm-8hw2-v72w", + "modified": "2024-03-25T19:38:18Z", + "published": "2024-03-25T19:38:18Z", + "aliases": [ + "CVE-2024-28243" + ], + "summary": "KaTeX's maxExpand bypassed by `\\edef`", + "details": "### Impact\nKaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.\n\n### Patches\nUpgrade to KaTeX v0.16.10 to remove this vulnerability.\n\n### Workarounds\nForbid inputs containing the substring `\"\\\\edef\"` before passing them to KaTeX.\n(There is no easy workaround for the auto-render extension.)\n\n### Details\nKaTeX supports an option named `maxExpand` which prevents infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. However, what counted as an \"expansion\" is a single macro expanding to any number of tokens. The expand-and-define TeX command `\\edef` can be used to build up an exponential number of tokens using only a linear number of expansions according to this definition, e.g. by repeatedly doubling the previous definition. This has been corrected in KaTeX v0.16.10, where every expanded token in an `\\edef` counts as an expansion.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)\n* Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "katex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.10.0-beta" + }, + { + "fixed": "0.16.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w" + }, + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34" + }, + { + "type": "PACKAGE", + "url": "https://github.com/KaTeX/KaTeX" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-606" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:38:18Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json b/advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json new file mode 100644 index 00000000000..6eb478c7bf1 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cvr6-37gx-v8wc", + "modified": "2024-03-25T19:38:29Z", + "published": "2024-03-25T19:38:29Z", + "aliases": [ + "CVE-2024-28244" + ], + "summary": "KaTeX's maxExpand bypassed by Unicode sub/superscripts", + "details": "### Impact\nKaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\def` or `\\newcommand` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.\n\n### Patches\nUpgrade to KaTeX v0.16.10 to remove this vulnerability.\n\n### Workarounds\nForbid inputs containing any of the characters `₊₋₌₍₎₀₁₂₃₄₅₆₇₈₉ₐₑₕᵢⱼₖₗₘₙₒₚᵣₛₜᵤᵥₓᵦᵧᵨᵩᵪ⁺⁻⁼⁽⁾⁰¹²³⁴⁵⁶⁷⁸⁹ᵃᵇᶜᵈᵉᵍʰⁱʲᵏˡᵐⁿᵒᵖʳˢᵗᵘʷˣʸᶻᵛᵝᵞᵟᵠᵡ` before passing them to KaTeX.\n(There is no easy workaround for the auto-render extension.)\n\n### Details\nKaTeX supports an option named `maxExpand` which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, [support for \"Unicode (sub|super)script characters\"](https://github.com/KaTeX/KaTeX/commit/d8fc35e6a97f8e561c723b93ad275cf5a7f3094a) allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent. This has been corrected in KaTeX v0.16.10.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)\n* Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "katex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.15.4" + }, + { + "fixed": "0.16.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cvr6-37gx-v8wc" + }, + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/KaTeX/KaTeX" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-606" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:38:29Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json b/advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json new file mode 100644 index 00000000000..087bb4813df --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f98w-7cxr-ff2h", + "modified": "2024-03-25T19:38:34Z", + "published": "2024-03-25T19:38:34Z", + "aliases": [ + "CVE-2024-28245" + ], + "summary": "KaTeX's `\\includegraphics` does not escape filename", + "details": "### Impact\nKaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML.\n\n### Patches\nUpgrade to KaTeX v0.16.10 to remove this vulnerability.\n\n### Workarounds\n* Avoid use of or turn off the `trust` option, or set it to forbid `\\includegraphics` commands.\n* Forbid inputs containing the substring `\"\\\\includegraphics\"`.\n* Sanitize HTML output from KaTeX.\n\n### Details\n`\\includegraphics` did not properly quote its filename argument, allowing it to generate invalid or malicious HTML that runs scripts.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)\n* Email us at katex-security@mit.edu", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "katex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.11.0" + }, + { + "fixed": "0.16.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h" + }, + { + "type": "WEB", + "url": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770" + }, + { + "type": "PACKAGE", + "url": "https://github.com/KaTeX/KaTeX" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-116" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:38:34Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-vxq2-p937-3px3/GHSA-vxq2-p937-3px3.json b/advisories/github-reviewed/2024/03/GHSA-vxq2-p937-3px3/GHSA-vxq2-p937-3px3.json new file mode 100644 index 00000000000..21b903d80e2 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-vxq2-p937-3px3/GHSA-vxq2-p937-3px3.json @@ -0,0 +1,102 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxq2-p937-3px3", + "modified": "2024-03-25T19:39:21Z", + "published": "2024-03-25T19:39:21Z", + "aliases": [ + "CVE-2023-45824" + ], + "summary": "Pinned entity creation form shows wrong data", + "details": "### Impact\n\nLogged in user can access page state data of pinned pages of other users by pageId hash.\n\n\n### Patch\n\n```patch\n--- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php\n+++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php\n@@ -158,6 +158,13 @@\n AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId'))\n );\n \n+ if ($entity) {\n+ $entity = $this->getEntity($entity->getId());\n+ }\n+ if (!$entity) {\n+ return $this->handleNotFound();\n+ }\n+\n return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK));\n }\n \n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "oro/platform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "5.1.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.1.3" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "oro/platform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "last_affected": "5.0.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "oro/platform" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "last_affected": "4.2.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3" + }, + { + "type": "WEB", + "url": "https://github.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd" + }, + { + "type": "PACKAGE", + "url": "https://github.com/oroinc/platform" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:39:21Z", + "nvd_published_at": null + } +} \ No newline at end of file