diff --git a/advisories/github-reviewed/2025/02/GHSA-3qxh-p7jc-5xh6/GHSA-3qxh-p7jc-5xh6.json b/advisories/github-reviewed/2025/02/GHSA-3qxh-p7jc-5xh6/GHSA-3qxh-p7jc-5xh6.json new file mode 100644 index 00000000000..b5712bbc6ef --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-3qxh-p7jc-5xh6/GHSA-3qxh-p7jc-5xh6.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3qxh-p7jc-5xh6", + "modified": "2025-02-25T17:49:40Z", + "published": "2025-02-25T17:49:40Z", + "aliases": [ + "CVE-2025-27109" + ], + "summary": "Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)", + "details": "Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.\n\nFor instance, `?text=` would trigger XSS here.\n```js\n const [text] = createResource(() => {\n return new URL(getRequestEvent().request.url).searchParams.get(\"text\");\n });\n\n return (\n <>\n Text: {text()}\n \n );\n ```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "solid-js" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.9.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/solidjs/solid/security/advisories/GHSA-3qxh-p7jc-5xh6" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27109" + }, + { + "type": "WEB", + "url": "https://github.com/solidjs/solid/commit/b93956f28ed75469af6976a98728e313d0edd236" + }, + { + "type": "PACKAGE", + "url": "https://github.com/solidjs/solid" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-116", + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-25T17:49:40Z", + "nvd_published_at": "2025-02-21T22:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-c3p4-vm8f-386p/GHSA-c3p4-vm8f-386p.json b/advisories/github-reviewed/2025/02/GHSA-c3p4-vm8f-386p/GHSA-c3p4-vm8f-386p.json new file mode 100644 index 00000000000..901c669be5f --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-c3p4-vm8f-386p/GHSA-c3p4-vm8f-386p.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c3p4-vm8f-386p", + "modified": "2025-02-25T17:49:07Z", + "published": "2025-02-25T17:49:07Z", + "aliases": [ + "CVE-2025-27112" + ], + "summary": "Navidrome allows an authentication bypass in Subsonic API with non-existent username", + "details": "### Summary\n\nIn certain Subsonic API endpoints, authentication can be bypassed by using a non-existent username combined with an empty (salted) password hash. This allows read-only access to the server’s resources, though attempts at write operations fail with a “permission denied” error.\n\n### Details\n\nA flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as authenticated, granting access to various Subsonic endpoints without requiring valid credentials.\n\n### Proof of Concept (PoC)\n\n1. Generate a random salt:\n\n ```javascript\n // e.g., salt = \"x1vbudn1m6d\"\n Math.random().toString(36).substring(2, 15)\n ```\n\n2. Calculate the MD5 hash of an empty password plus the salt:\n\n ```shell\n # Using the example salt above\n echo -n \"x1vbudn1m6d\" | md5sum\n 81f0c0fb5d202ab0d012e6eaeb722d79 -\n ```\n\n3. Send a request specifying a fake user, with the hash and salt values:\n\n ```\n GET https://[host]/rest/getPlaylists?u=FakeUser&t=81f0c0fb5d202ab0d012e6eaeb722d79&s=x1vbudn1m6d&v=1.16.1&c=castafiore&f=json\n ```\n\n### Impact\n\nAn attacker can use any non-existent username to bypass the authentication system and gain access to various read-only data in Navidrome, such as user playlists. However, any attempt to modify data fails due to insufficient permissions, limiting the impact to unauthorized viewing of information.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/navidrome/navidrome" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.52.0" + }, + { + "fixed": "0.54.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-c3p4-vm8f-386p" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27112" + }, + { + "type": "WEB", + "url": "https://github.com/navidrome/navidrome/commit/09ae41a2da66264c60ef307882362d2e2d8d8b89" + }, + { + "type": "WEB", + "url": "https://github.com/navidrome/navidrome/commit/287079a9e409fb6b9708ca384d7daa7b5185c1a0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/navidrome/navidrome" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-25T17:49:07Z", + "nvd_published_at": "2025-02-24T19:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-hw62-58pr-7wc5/GHSA-hw62-58pr-7wc5.json b/advisories/github-reviewed/2025/02/GHSA-hw62-58pr-7wc5/GHSA-hw62-58pr-7wc5.json new file mode 100644 index 00000000000..7246b9b9305 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-hw62-58pr-7wc5/GHSA-hw62-58pr-7wc5.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hw62-58pr-7wc5", + "modified": "2025-02-25T17:49:58Z", + "published": "2025-02-25T17:49:57Z", + "aliases": [ + "CVE-2025-27108" + ], + "summary": "DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace", + "details": "> [!NOTE] \n> This advisory was originally emailed to community@solidjs.com by @nsysean.\n\nTo sum it up, the use of javascript's `.replace()` opens up to potential XSS vulnerabilities with the special replacement patterns beginning with `$`.\n\nParticularly, when the attributes of `Meta` tag from solid-meta are user-defined, attackers can utilise the special replacement patterns, either `$'` or `$\\`` to achieve XSS.\n\nThe solid-meta package has this issue since it uses `useAffect` and context providers, which injects the used assets in the html header. \"dom-expressions\" uses `.replace()` to insert the assets, which is vulnerable to the special replacement patterns listed above. \n\nThis effectively means that if the attributes of an asset tag contained user-controlled data, it would be vulnerable to XSS. For instance, there might be meta tags for the open graph protocol in a user profile page, but if attackers set the user query to some payload abusing `.replace()`, then they could execute arbitrary javascript in the victim's web browser. Moreover, it could be stored and cause more problems.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "dom-expressions" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.39.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ryansolid/dom-expressions/security/advisories/GHSA-hw62-58pr-7wc5" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27108" + }, + { + "type": "WEB", + "url": "https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ryansolid/dom-expressions" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-116", + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-25T17:49:57Z", + "nvd_published_at": "2025-02-21T22:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-mcgx-2gcr-p3hp/GHSA-mcgx-2gcr-p3hp.json b/advisories/github-reviewed/2025/02/GHSA-mcgx-2gcr-p3hp/GHSA-mcgx-2gcr-p3hp.json new file mode 100644 index 00000000000..92ab5b349c4 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-mcgx-2gcr-p3hp/GHSA-mcgx-2gcr-p3hp.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mcgx-2gcr-p3hp", + "modified": "2025-02-25T17:48:34Z", + "published": "2025-02-25T17:48:34Z", + "aliases": [ + "CVE-2023-25574" + ], + "summary": "LTI JupyterHub Authenticator does not properly validate JWT Signature", + "details": "### Impact\n\nOnly users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are influenced.\n\nLTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request granting access to existing and new user identities.\n\n### Patches\n\nNone.\n\n### Workarounds\n\nNone.\n\n### References\n\n- [This code segment](https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164) didn't validate a JWT signature.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "jupyterhub-ltiauthenticator" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.3.0" + }, + { + "fixed": "1.4.0" + } + ] + } + ], + "versions": [ + "1.3.0" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-mcgx-2gcr-p3hp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25574" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jupyterhub/ltiauthenticator" + }, + { + "type": "WEB", + "url": "https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164" + }, + { + "type": "WEB", + "url": "https://github.com/jupyterhub/ltiauthenticator/blob/main/CHANGELOG.md#140---2023-03-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-25T17:48:34Z", + "nvd_published_at": "2025-02-25T15:15:16Z" + } +} \ No newline at end of file