From 6a6e8c98507db626deb3cc5133a119431cc750a7 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 31 May 2024 20:34:23 +0000
Subject: [PATCH] Publish Advisories

GHSA-624g-8qjg-8qxf
GHSA-7r3j-qmr4-jfpj
GHSA-gx8m-f3mp-fg99
---
 .../2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json  | 4 ++--
 .../2024/05/GHSA-7r3j-qmr4-jfpj/GHSA-7r3j-qmr4-jfpj.json  | 6 +++++-
 .../2024/05/GHSA-gx8m-f3mp-fg99/GHSA-gx8m-f3mp-fg99.json  | 8 ++++++--
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json b/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json
index de33102e06e..457d06b2de0 100644
--- a/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json
+++ b/advisories/github-reviewed/2024/04/GHSA-624g-8qjg-8qxf/GHSA-624g-8qjg-8qxf.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-624g-8qjg-8qxf",
-  "modified": "2024-04-24T14:26:34Z",
+  "modified": "2024-05-31T20:32:54Z",
   "published": "2024-04-23T21:15:55Z",
   "aliases": [
     "CVE-2024-32866"
   ],
   "summary": "Conform contains a Prototype Pollution Vulnerability in `parseWith...` function",
-  "details": "### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\");\n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n",
+  "details": "### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\"); \n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2024/05/GHSA-7r3j-qmr4-jfpj/GHSA-7r3j-qmr4-jfpj.json b/advisories/github-reviewed/2024/05/GHSA-7r3j-qmr4-jfpj/GHSA-7r3j-qmr4-jfpj.json
index 21c98820dc3..972bd44eb9a 100644
--- a/advisories/github-reviewed/2024/05/GHSA-7r3j-qmr4-jfpj/GHSA-7r3j-qmr4-jfpj.json
+++ b/advisories/github-reviewed/2024/05/GHSA-7r3j-qmr4-jfpj/GHSA-7r3j-qmr4-jfpj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7r3j-qmr4-jfpj",
-  "modified": "2024-05-28T15:47:00Z",
+  "modified": "2024-05-31T20:33:21Z",
   "published": "2024-05-28T15:47:00Z",
   "aliases": [
     "CVE-2024-32978"
@@ -50,6 +50,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/kaminari/kaminari"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kaminari/CVE-2024-32978.yml"
     }
   ],
   "database_specific": {
diff --git a/advisories/github-reviewed/2024/05/GHSA-gx8m-f3mp-fg99/GHSA-gx8m-f3mp-fg99.json b/advisories/github-reviewed/2024/05/GHSA-gx8m-f3mp-fg99/GHSA-gx8m-f3mp-fg99.json
index 6c863ca6bdf..868540f9441 100644
--- a/advisories/github-reviewed/2024/05/GHSA-gx8m-f3mp-fg99/GHSA-gx8m-f3mp-fg99.json
+++ b/advisories/github-reviewed/2024/05/GHSA-gx8m-f3mp-fg99/GHSA-gx8m-f3mp-fg99.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gx8m-f3mp-fg99",
-  "modified": "2024-05-28T16:54:31Z",
+  "modified": "2024-05-31T20:33:40Z",
   "published": "2024-05-28T16:54:31Z",
   "aliases": [
     "CVE-2024-35621"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/getformwork/formwork/security/advisories/GHSA-gx8m-f3mp-fg99"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35621"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/getformwork/formwork/commit/2d92e6dbf99a9a49797947afbda0cdd4e56e11df"
@@ -60,6 +64,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-05-28T16:54:31Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-05-28T16:15:16Z"
   }
 }
\ No newline at end of file