mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-3qxh-p7jc-5xh6 GHSA-c3p4-vm8f-386p GHSA-hw62-58pr-7wc5 GHSA-mcgx-2gcr-p3hp
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,66 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3qxh-p7jc-5xh6",
|
||||
"modified": "2025-02-25T17:49:40Z",
|
||||
"published": "2025-02-25T17:49:40Z",
|
||||
"aliases": [
|
||||
"CVE-2025-27109"
|
||||
],
|
||||
"summary": "Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)",
|
||||
"details": "Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.\n\nFor instance, `?text=<svg/onload=alert(1)>` would trigger XSS here.\n```js\n const [text] = createResource(() => {\n return new URL(getRequestEvent().request.url).searchParams.get(\"text\");\n });\n\n return (\n <>\n Text: {text()}\n </>\n );\n ```",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "npm",
|
||||
"name": "solid-js"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "1.9.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/solidjs/solid/security/advisories/GHSA-3qxh-p7jc-5xh6"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27109"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/solidjs/solid/commit/b93956f28ed75469af6976a98728e313d0edd236"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/solidjs/solid"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-116",
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-02-25T17:49:40Z",
|
||||
"nvd_published_at": "2025-02-21T22:15:14Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,69 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-c3p4-vm8f-386p",
|
||||
"modified": "2025-02-25T17:49:07Z",
|
||||
"published": "2025-02-25T17:49:07Z",
|
||||
"aliases": [
|
||||
"CVE-2025-27112"
|
||||
],
|
||||
"summary": "Navidrome allows an authentication bypass in Subsonic API with non-existent username",
|
||||
"details": "### Summary\n\nIn certain Subsonic API endpoints, authentication can be bypassed by using a non-existent username combined with an empty (salted) password hash. This allows read-only access to the server’s resources, though attempts at write operations fail with a “permission denied” error.\n\n### Details\n\nA flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials.\n\n### Proof of Concept (PoC)\n\n1. Generate a random salt:\n\n ```javascript\n // e.g., salt = \"x1vbudn1m6d\"\n Math.random().toString(36).substring(2, 15)\n ```\n\n2. Calculate the MD5 hash of an empty password plus the salt:\n\n ```shell\n # Using the example salt above\n echo -n \"x1vbudn1m6d\" | md5sum\n 81f0c0fb5d202ab0d012e6eaeb722d79 -\n ```\n\n3. Send a request specifying a fake user, with the hash and salt values:\n\n ```\n GET https://[host]/rest/getPlaylists?u=FakeUser&t=81f0c0fb5d202ab0d012e6eaeb722d79&s=x1vbudn1m6d&v=1.16.1&c=castafiore&f=json\n ```\n\n### Impact\n\nAn attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails due to insufficient permissions, limiting the impact to unauthorized viewing of information.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/navidrome/navidrome"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0.52.0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.54.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27112"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/navidrome/navidrome/commit/09ae41a2da66264c60ef307882362d2e2d8d8b89"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/navidrome/navidrome"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-287"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-02-25T17:49:07Z",
|
||||
"nvd_published_at": "2025-02-24T19:15:14Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hw62-58pr-7wc5",
|
||||
"modified": "2025-02-25T17:49:58Z",
|
||||
"published": "2025-02-25T17:49:57Z",
|
||||
"aliases": [
|
||||
"CVE-2025-27108"
|
||||
],
|
||||
"summary": "DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace",
|
||||
"details": "> [!NOTE] \n> This advisory was originally emailed to community@solidjs.com by @nsysean.\n\nTo sum it up, the use of javascript's `.replace()` opens up to potential XSS vulnerabilities with the special replacement patterns beginning with `$`.\n\nParticularly, when the attributes of `Meta` tag from solid-meta are user-defined, attackers can utilise the special replacement patterns, either `$'` or `$\\`` to achieve XSS.\n\nThe solid-meta package has this issue since it uses `useAffect` and context providers, which injects the used assets in the html header. \"dom-expressions\" uses `.replace()` to insert the assets, which is vulnerable to the special replacement patterns listed above. \n\nThis effectively means that if the attributes of an asset tag contained user-controlled data, it would be vulnerable to XSS. For instance, there might be meta tags for the open graph protocol in a user profile page, but if attackers set the user query to some payload abusing `.replace()`, then they could execute arbitrary javascript in the victim's web browser. Moreover, it could be stored and cause more problems.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "npm",
|
||||
"name": "dom-expressions"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.39.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/ryansolid/dom-expressions/security/advisories/GHSA-hw62-58pr-7wc5"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27108"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/ryansolid/dom-expressions"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-116",
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-02-25T17:49:57Z",
|
||||
"nvd_published_at": "2025-02-21T22:15:14Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-mcgx-2gcr-p3hp",
|
||||
"modified": "2025-02-25T17:48:34Z",
|
||||
"published": "2025-02-25T17:48:34Z",
|
||||
"aliases": [
|
||||
"CVE-2023-25574"
|
||||
],
|
||||
"summary": "LTI JupyterHub Authenticator does not properly validate JWT Signature",
|
||||
"details": "### Impact\n\nOnly users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are influenced.\n\nLTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request granting access to existing and new user identities.\n\n### Patches\n\nNone.\n\n### Workarounds\n\nNone.\n\n### References\n\n- [This code segment](https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164) didn't validate a JWT signature.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "PyPI",
|
||||
"name": "jupyterhub-ltiauthenticator"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "1.3.0"
|
||||
},
|
||||
{
|
||||
"fixed": "1.4.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": [
|
||||
"1.3.0"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-mcgx-2gcr-p3hp"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25574"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/jupyterhub/ltiauthenticator"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/jupyterhub/ltiauthenticator/blob/main/CHANGELOG.md#140---2023-03-01"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-347"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-02-25T17:48:34Z",
|
||||
"nvd_published_at": "2025-02-25T15:15:16Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user