Publish Advisories

GHSA-4gm4-c4mh-4p7w GHSA-p36r-qxgx-jq2v
2026-05-22 18:04:22 -07:00 · 2024-06-17 22:29:57 +00:00
parent 7503c60a6f
commit 75e8352097
2 changed files with 132 additions and 0 deletions
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4gm4-c4mh-4p7w",
+  "modified": "2024-06-17T22:28:28Z",
+  "published": "2024-06-17T22:28:28Z",
+  "aliases": [
+    "CVE-2024-37893"
+  ],
+  "summary": "Firefly III has a MFA bypass in oauth flow",
+  "details": "### Impact\n\nA MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an incrementing id, an attacker could try sign an OAuth application up to a users profile quite easily if they have created one. The attacker would also need to know the victims username and password.\n\n### Patches\n\nProblem has been patched in Firefly III v6.1.17 and up.\n\n### Workarounds\n\n- Use a unique password for your Firefly III instance,\n- Store your password securely, i.e. in a password manager or in your head.\n\n### References\n\n- https://owasp.org/www-community/attacks/Password_Spraying_Attack\n- https://www.menlosecurity.com/what-is/highly-evasive-adaptive-threats-heat/mfa-bypass\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "grumpydictator/firefly-iii"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "6.1.17"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-4gm4-c4mh-4p7w"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37893"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/firefly-iii/firefly-iii"
+    },
+    {
+      "type": "WEB",
+      "url": "https://owasp.org/www-community/attacks/Password_Spraying_Attack"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.menlosecurity.com/what-is/highly-evasive-adaptive-threats-heat/mfa-bypass"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-287",
+      "CWE-288"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-17T22:28:28Z",
+    "nvd_published_at": "2024-06-17T20:15:13Z"
+  }
+}
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p36r-qxgx-jq2v",
+  "modified": "2024-06-17T22:28:41Z",
+  "published": "2024-06-17T22:28:41Z",
+  "aliases": [
+    "CVE-2024-37895"
+  ],
+  "summary": "Lobe Chat API Key Leak",
+  "details": "### Summary\n\nIf an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request.\n\n### Details\n\nThe attack process is described above.\n\n![image](https://github.com/lobehub/lobe-chat/assets/36695271/df5e0c3c-af28-45c3-959f-182cc9d06680)\n\n### PoC\n\nFrontend:\n1. Pass basic authentication (SSO/Access Code).\n2. Set the Base URL to a private attack address.\n3. Configure the request method to be a server-side request.\n4. At the self-set attack address, retrieve the API Key information from the request headers.\n\nBackend:\n1. The LobeChat version allows setting the Base URL.\n2. There is no outbound traffic whitelist.\n\n### Impact\n\nAll community version LobeChat users using SSO/Access Code authentication, tested on version 0.162.13.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@lobehub/chat"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.162.25"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-p36r-qxgx-jq2v"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37895"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/lobehub/lobe-chat"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200",
+      "CWE-918"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-17T22:28:41Z",
+    "nvd_published_at": "2024-06-17T20:15:13Z"
+  }
+}