Publish Advisories

GHSA-624g-8qjg-8qxf
GHSA-7r3j-qmr4-jfpj
GHSA-gx8m-f3mp-fg99

advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-624g-8qjg-8qxf",
-  "modified": "2024-04-24T14:26:34Z",
+  "modified": "2024-05-31T20:32:54Z",
   "published": "2024-04-23T21:15:55Z",
   "aliases": [
     "CVE-2024-32866"
   ],
   "summary": "Conform contains a Prototype Pollution Vulnerability in `parseWith...` function",
-  "details": "### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\");\n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n",
+  "details": "### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\"); \n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2024/05/GHSA-7r3j-qmr4-jfpj/GHSA-7r3j-qmr4-jfpj.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7r3j-qmr4-jfpj",
-  "modified": "2024-05-28T15:47:00Z",
+  "modified": "2024-05-31T20:33:21Z",
   "published": "2024-05-28T15:47:00Z",
   "aliases": [
     "CVE-2024-32978"
@@ -50,6 +50,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/kaminari/kaminari"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kaminari/CVE-2024-32978.yml"
     }
   ],
   "database_specific": {

advisories/github-reviewed/2024/05/GHSA-gx8m-f3mp-fg99/GHSA-gx8m-f3mp-fg99.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gx8m-f3mp-fg99",
-  "modified": "2024-05-28T16:54:31Z",
+  "modified": "2024-05-31T20:33:40Z",
   "published": "2024-05-28T16:54:31Z",
   "aliases": [
     "CVE-2024-35621"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/getformwork/formwork/security/advisories/GHSA-gx8m-f3mp-fg99"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35621"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/getformwork/formwork/commit/2d92e6dbf99a9a49797947afbda0cdd4e56e11df"
@@ -60,6 +64,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-05-28T16:54:31Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-05-28T16:15:16Z"
   }
 }