diff --git a/advisories/github-reviewed/2024/03/GHSA-hp2x-6vrm-7j7v/GHSA-hp2x-6vrm-7j7v.json b/advisories/github-reviewed/2024/03/GHSA-hp2x-6vrm-7j7v/GHSA-hp2x-6vrm-7j7v.json index 16a911cd41e..205931f079e 100644 --- a/advisories/github-reviewed/2024/03/GHSA-hp2x-6vrm-7j7v/GHSA-hp2x-6vrm-7j7v.json +++ b/advisories/github-reviewed/2024/03/GHSA-hp2x-6vrm-7j7v/GHSA-hp2x-6vrm-7j7v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hp2x-6vrm-7j7v", - "modified": "2024-05-02T13:17:21Z", + "modified": "2024-12-04T22:18:37Z", "published": "2024-03-01T18:30:23Z", "aliases": [ "CVE-2024-27140" @@ -9,7 +9,10 @@ "summary": "Apache Archiva Reflected Cross-site Scripting vulnerability", "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva.\n\nThis issue affects Apache Archiva: from 2.0.0.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/06/GHSA-r82w-3phg-qvr4/GHSA-r82w-3phg-qvr4.json b/advisories/github-reviewed/2024/06/GHSA-r82w-3phg-qvr4/GHSA-r82w-3phg-qvr4.json index b6ae7dffb64..305fb2f2b57 100644 --- a/advisories/github-reviewed/2024/06/GHSA-r82w-3phg-qvr4/GHSA-r82w-3phg-qvr4.json +++ b/advisories/github-reviewed/2024/06/GHSA-r82w-3phg-qvr4/GHSA-r82w-3phg-qvr4.json @@ -136,7 +136,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-324" + "CWE-324", + "CWE-326" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json b/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json index d134dadf6a9..379c76d8126 100644 --- a/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json +++ b/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-3jm4-c6qf-jrh3", - "modified": "2024-10-24T21:46:00Z", + "modified": "2024-12-04T22:18:02Z", "published": "2024-10-24T17:58:53Z", "aliases": [ "CVE-2024-47879" ], "summary": "OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)", - "details": "### Summary\n\nLack of CSRF protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code.\n\nThe attacker must know a valid project ID of a project that contains at least one row.\n\n### Details\n\nThe `com.google.refine.commands.expr.PreviewExpressionCommand` class contains the following comment:\n\n```\n/**\n * The command uses POST but does not actually modify any state so it does not require CSRF.\n */\n```\n\nHowever, this appears to be false (or no longer true). The expression being previewed (executed) can be written in GREL, Python, or Clojure. Since there are no restrictions on what code can be executed, the expression can do anything the user running OpenRefine can do. For instance, the following expressions start a calculator:\n\n```\nclojure:(.exec (Runtime/getRuntime) \"gnome-calculator\")\n```\n\n```\njython:import os;os.system(\"gnome-calculator\")\n```\n\nThe lack of restrictions on expressions is arguably not a problem if the user is typing their own expressions into OpenRefine: they could have just as well typed them into Clojure or Python directly. However, since the `preview-expression` command does not check for a CSRF token, the expression can actually come from a HTML form submitted by a different origin, including arbitrary websites.\n\nIssue #2164 suggested adding CSRF protection to all endpoints, but this endpoint was skipped (and the above comment added) in the associated PR #2182.\n\n### PoC\n\nAn example \"malicious\" page is at https://wandernauta.nl/or/ (of course, actual malicious pages would not wait for the victim to press the submit button).\n\nThe following curl command (substituting the project ID) also demonstrates the issue:\n\n```sh\ncurl -d project=123456789 -d cellIndex=1 -d rowIndices='[0]' -d 'expression=clojure:(.exec (Runtime/getRuntime) \"gnome-calculator\")' http://localhost:3333/command/core/preview-expression/\n```\n\n### Impact\n\nCSRF into remote code execution, provided the attacker knows at least one project ID in the victim's workspace and can convince the victim to open a malicious webpage.", + "details": "### Summary\n\nLack of CSRF protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code.\n\nThe attacker must know a valid project ID of a project that contains at least one row.\n\n### Details\n\nThe `com.google.refine.commands.expr.PreviewExpressionCommand` class contains the following comment:\n```\n/**\n * The command uses POST but does not actually modify any state so it does not require CSRF.\n */\n```\n\nHowever, this appears to be false (or no longer true). The expression being previewed (executed) can be written in GREL, Python, or Clojure. Since there are no restrictions on what code can be executed, the expression can do anything the user running OpenRefine can do. For instance, the following expressions start a calculator:\n\n```\nclojure:(.exec (Runtime/getRuntime) \"gnome-calculator\")\n```\n\n```\njython:import os;os.system(\"gnome-calculator\")\n```\n\nThe lack of restrictions on expressions is arguably not a problem if the user is typing their own expressions into OpenRefine: they could have just as well typed them into Clojure or Python directly. However, since the `preview-expression` command does not check for a CSRF token, the expression can actually come from a HTML form submitted by a different origin, including arbitrary websites.\n\nIssue #2164 suggested adding CSRF protection to all endpoints, but this endpoint was skipped (and the above comment added) in the associated PR #2182.\n\n### PoC\n\nAn example \"malicious\" page is at https://wandernauta.nl/or/ (of course, actual malicious pages would not wait for the victim to press the submit button).\n\nThe following curl command (substituting the project ID) also demonstrates the issue:\n\n```sh\ncurl -d project=123456789 -d cellIndex=1 -d rowIndices='[0]' -d 'expression=clojure:(.exec (Runtime/getRuntime) \"gnome-calculator\")' http://localhost:3333/command/core/preview-expression/\n```\n\n### Impact\n\nCSRF into remote code execution, provided the attacker knows at least one project ID in the victim's workspace and can convince the victim to open a malicious webpage.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/10/GHSA-9mjw-79r6-c9m8/GHSA-9mjw-79r6-c9m8.json b/advisories/github-reviewed/2024/10/GHSA-9mjw-79r6-c9m8/GHSA-9mjw-79r6-c9m8.json index 9c54718dbad..8f1885858e1 100644 --- a/advisories/github-reviewed/2024/10/GHSA-9mjw-79r6-c9m8/GHSA-9mjw-79r6-c9m8.json +++ b/advisories/github-reviewed/2024/10/GHSA-9mjw-79r6-c9m8/GHSA-9mjw-79r6-c9m8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9mjw-79r6-c9m8", - "modified": "2024-10-09T22:36:19Z", + "modified": "2024-12-04T22:18:00Z", "published": "2024-10-02T06:30:26Z", "aliases": [ "CVE-2024-33662" @@ -71,6 +71,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-326", "CWE-327" ], "severity": "HIGH",