netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2hj5-g64g-fp6p
GHSA-93m4-mfpg-c3xf
GHSA-wxr5-93ph-8wr9
This commit is contained in:
advisory-database[bot]
2025-05-28 17:37:51 +00:00
parent 4173dd47d1
commit 60cc847e51
3 changed files with 311 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/05/GHSA-2hj5-g64g-fp6p/GHSA-2hj5-g64g-fp6p.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2hj5-g64g-fp6p",
"modified": "2025-05-28T17:36:33Z",
"published": "2025-05-28T17:36:32Z",
"aliases": [
"CVE-2025-47933"
],
"summary": "Argo CD allows cross-site scripting on repositories page",
"details": "### Impact\nThis vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository.\n\nIn `ui/src/app/shared/components/urls.ts`, the following code exists to parse the repository URL.\n\nhttps://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/urls.ts#L14-L26\n\nSince this code doesn't validate the protocol of repository URLs, it's possible to inject `javascript:` URLs here.\n\nhttps://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/repo.tsx#L5-L7\n\nAs the return value of this function is used in the `href` attribute of the `a` tag, it's possible to achieve cross-site scripting by using `javascript:` URLs.\n\nBrowsers may return the proper hostname for `javascript:` URLs, allowing exploitation of this vulnerability.\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n- v3.0.4\n- v2.14.13\n- v2.13.8\n\n\nThe patch incorporates a way to validate the URL being passed in. Returning `null` if the validation fails.\n\n### Workarounds\nThere are no workarounds other than depending on the browser to filter the URL. \n\n### Credits\nDisclosed by @Ry0taK [RyotaK](https://ryotak.net). \n\n### For more information\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.2.0-rc1"
},
{
"last_affected": "1.8.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0-rc3"
},
{
"fixed": "2.13.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.14.0-rc1"
},
{
"fixed": "2.14.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd/v3"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.4"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6p"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1"
},
{
"type": "PACKAGE",
"url": "https://github.com/argoproj/argo-cd"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T17:36:32Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2025/05/GHSA-93m4-mfpg-c3xf/GHSA-93m4-mfpg-c3xf.json
+138
View File
@@ -0,0 +1,138 @@
{
"schema_version": "1.4.0",
"id": "GHSA-93m4-mfpg-c3xf",
"modified": "2025-05-28T17:36:55Z",
"published": "2025-05-28T17:36:55Z",
"aliases": [],
"summary": "ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection",
"details": "### Impact\n\nA potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user.\n\nIf an attacker can manipulate these headers (e.g., via host header injection), they could cause ZITADEL to generate a password reset link pointing to a malicious domain controlled by the attacker. If the user clicks this manipulated link in the email, the secret reset code embedded in the URL can be captured by the attacker. This captured code could then be used to reset the user's password and gain unauthorized access to their account.\n\nIt's important to note that this specific attack vector is mitigated for accounts that have Multi-Factor Authentication (MFA) or Passwordless authentication enabled.\n\n### Patches\n\nPatched version ensure proper validation of the headers and do not allow downgrading from https to http.\n\n3.x versions are fixed on >=[3.2.2](https://github.com/zitadel/zitadel/releases/tag/v3.2.2)\n2.71.x versions are fixed on >=[2.71.11](https://github.com/zitadel/zitadel/releases/tag/v2.71.11)\n2.x versions are fixed on >=[2.70.12](https://github.com/zitadel/zitadel/releases/tag/v2.70.12)\n\n### Workarounds\n\nThe recommended solution is to update ZITADEL to a patched version.\n\nA ZITADEL fronting proxy can be configured to delete all Forwarded and X-Forwarded-Host header values before sending requests to ZITADEL self-hosted environments.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Amit Laish – GE Vernova for finding and reporting the vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20250528081227-c097887bc5f6"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.38.3"
},
{
"fixed": "2.70.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0-rc1"
},
{
"fixed": "3.2.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.71.0"
},
{
"fixed": "2.71.11"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.71.10"
}
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "< 2.38.2-0.20240919104753-94d1eb767837"
}
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-93m4-mfpg-c3xf"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/commit/c097887bc5f680e12c998580fb56d98a15758f53"
},
{
"type": "PACKAGE",
"url": "https://github.com/zitadel/zitadel"
}
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T17:36:55Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2025/05/GHSA-wxr5-93ph-8wr9/GHSA-wxr5-93ph-8wr9.json → advisories/github-reviewed/2025/05/GHSA-wxr5-93ph-8wr9/GHSA-wxr5-93ph-8wr9.json
+55 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wxr5-93ph-8wr9",
"modified": "2025-05-28T15:34:34Z",
"modified": "2025-05-28T17:37:18Z",
"published": "2025-05-28T15:34:34Z",
"aliases": [
"CVE-2025-48734"
],
"summary": "Apache Commons Improper Access Control vulnerability",
"details": "Improper Access Control vulnerability in Apache Commons.\n\n\n\nA special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.\n\n\n\n\n\nReleases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().\nStarting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.\n\nThis issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils\n\n 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.\n\n\nUsers of the artifact org.apache.commons:commons-beanutils2\n\n 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.",
"severity": [
{
@@ -13,12 +14,62 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "commons-beanutils:commons-beanutils"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.0"
},
{
"fixed": "1.11.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 1.10.1"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.commons:commons-beanutils2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0-M1"
},
{
"fixed": "2.0.0-M2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734"
},
{
"type": "WEB",
"url": "https://github.com/apache/commons-beanutils/commit/bd20740da25b69552ddef8523beec0837297eaf9"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/commons-beanutils"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9"
@@ -29,8 +80,8 @@
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T17:37:18Z",
"nvd_published_at": "2025-05-28T14:15:34Z"
}
}