diff --git a/advisories/github-reviewed/2025/05/GHSA-96hh-8hx5-cpw7/GHSA-96hh-8hx5-cpw7.json b/advisories/github-reviewed/2025/05/GHSA-96hh-8hx5-cpw7/GHSA-96hh-8hx5-cpw7.json new file mode 100644 index 00000000000..cd2b79b6112 --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-96hh-8hx5-cpw7/GHSA-96hh-8hx5-cpw7.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-96hh-8hx5-cpw7", + "modified": "2025-05-05T14:55:41Z", + "published": "2025-05-05T14:55:41Z", + "aliases": [ + "CVE-2024-51991" + ], + "summary": "October CMS Allows Unprotected SVG Rename in Media Manager", + "details": "### Impact\n\nThis advisory affects authenticated administrators with sites that have the `media.clean_vectors` configuration enabled. This configuration will sanitize SVG files uploaded using the media manager. This vulnerability allows an authenticated user to bypass this protection by uploading it with a permitted extension (for example, .jpg or .png) and later modifying it to the .svg extension.\n\nThis vulnerability assumes a trusted user will attack another trusted user and cannot be actively exploited without access to the administration panel and interaction from the other user.\n\n### Patches\n\nThis issue has been patched in v3.7.5.\n\n### References\n\nCredits to:\n- [Cyber-Wo0dy](https://github.com/Cyber-Wo0dy)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "october/system" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "october/october" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/octobercms/october/security/advisories/GHSA-96hh-8hx5-cpw7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/octobercms/october" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-05-05T14:55:41Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-mwfg-948f-2cc5/GHSA-mwfg-948f-2cc5.json b/advisories/github-reviewed/2025/05/GHSA-mwfg-948f-2cc5/GHSA-mwfg-948f-2cc5.json new file mode 100644 index 00000000000..51dfc845ed4 --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-mwfg-948f-2cc5/GHSA-mwfg-948f-2cc5.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mwfg-948f-2cc5", + "modified": "2025-05-05T14:55:59Z", + "published": "2025-05-05T14:55:59Z", + "aliases": [ + "CVE-2025-46335" + ], + "summary": "Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload", + "details": "**Vulnerable MobSF Versions:** <= v4.3.2\n\n**CVSS V4.0 Score:** 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)\n\n**Details:**\nA Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow.\n\nWhen an Android Studio project contains a malicious SVG file as an app icon (e.g path, /app/src/main/res/mipmap-hdpi/ic_launcher.svg), and the project is zipped and uploaded to MobSF, the tool processes and extracts the contents without validating or sanitizing the SVG. \n\nUpcon ZIP extraction this icon file is saved by MobSF to: user/.MobSF/downloads/.svg\n\nThis file becomes publicly accessible via the web interface at:\n\nhttp://127.0.0.1:8081/download/filename.svg\n\nIf the SVG contains embedded JavaScript (e.g., an XSS payload), accessing this URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS.\n\n**Proof Of Concept:**\n\n1. Create a malicious SVG file (ic_launcher.svg) with an embedded XSS payload.\n\n![01](https://github.com/user-attachments/assets/9a89dec2-0671-490d-aba6-f38470bd84ee)\n\n2. Place the file in the Android Studio project directory: /app/src/main/res/mipmap-hdpi/ic_launcher.svg\n\n![02](https://github.com/user-attachments/assets/fc66f659-9f90-4be8-92c3-c5f26e1e11de)\n\n3. Zip the project directory and upload it to MobSF.\n\n![03](https://github.com/user-attachments/assets/a8465037-3b7a-42b7-89cf-5102c27917e7)\n\n4. After the scan, navigate to the \"Recent Scans\" page in the MobSF web interface and click on the scan entry and open the icon file in a new browser tab.\n\n![04](https://github.com/user-attachments/assets/5355e4d3-89a2-403a-a1a7-f60389fdbb8d)\n\n5. The XSS payload is executed, confirming the vulnerability.\n\n![05](https://github.com/user-attachments/assets/bc1e3493-1ffc-4598-b122-85459a406748)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "mobsf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.3.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.3.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-mwfg-948f-2cc5" + }, + { + "type": "WEB", + "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6987a946485a795f4fd38cebdb4860b368a1995d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-05T14:55:59Z", + "nvd_published_at": null + } +} \ No newline at end of file