diff --git a/advisories/github-reviewed/2024/08/GHSA-78x2-cwp9-5j42/GHSA-78x2-cwp9-5j42.json b/advisories/github-reviewed/2024/08/GHSA-78x2-cwp9-5j42/GHSA-78x2-cwp9-5j42.json new file mode 100644 index 00000000000..09476ed7ddb --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-78x2-cwp9-5j42/GHSA-78x2-cwp9-5j42.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-78x2-cwp9-5j42", + "modified": "2024-08-20T20:04:49Z", + "published": "2024-08-20T20:04:49Z", + "aliases": [ + "CVE-2024-43409" + ], + "summary": "Ghost's improper authentication allows access to member information and actions", + "details": "### Impact\n\nImproper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information.\n\n### Vulnerable versions\n\nThis security vulnerability is present in Ghost v4.46.0-v5.89.5.\n\n### Patches\n\nv5.89.5 contains a fix for this issue.\n\n### Workarounds\n\nNone.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Email us at [security@ghost.org](mailto:security@ghost.org)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "ghost" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.46.0" + }, + { + "fixed": "5.89.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@tryghost/portal" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.22.2" + }, + { + "fixed": "2.39.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-78x2-cwp9-5j42" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43409" + }, + { + "type": "WEB", + "url": "https://github.com/TryGhost/Ghost/commit/dac25612520b571f58679764ecc27109e641d1db" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TryGhost/Ghost" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T20:04:49Z", + "nvd_published_at": "2024-08-20T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-hh8p-374f-qgr5/GHSA-hh8p-374f-qgr5.json b/advisories/github-reviewed/2024/08/GHSA-hh8p-374f-qgr5/GHSA-hh8p-374f-qgr5.json new file mode 100644 index 00000000000..a822b0da8e6 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-hh8p-374f-qgr5/GHSA-hh8p-374f-qgr5.json @@ -0,0 +1,98 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hh8p-374f-qgr5", + "modified": "2024-08-20T20:04:53Z", + "published": "2024-08-20T18:31:26Z", + "aliases": [ + "CVE-2024-6322" + ], + "summary": "Grafana plugin data sources vulnerable to access control bypass", + "details": "Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.1.0" + }, + { + "fixed": "11.1.1" + } + ] + } + ], + "versions": [ + "11.1.0" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.1.2" + }, + { + "fixed": "11.1.3" + } + ] + } + ], + "versions": [ + "11.1.2" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6322" + }, + { + "type": "WEB", + "url": "https://github.com/grafana/grafana/commit/4cb3ba5d1a7ab8b9676034e89dada2fcde1766ef" + }, + { + "type": "WEB", + "url": "https://github.com/grafana/grafana/commit/9cdba084a9100c6b11d32eef9d2bd53656c6964a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/grafana/grafana" + }, + { + "type": "WEB", + "url": "https://grafana.com/security/security-advisories/cve-2024-6322" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T20:04:53Z", + "nvd_published_at": "2024-08-20T18:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-r5ph-4jxm-6j9p/GHSA-r5ph-4jxm-6j9p.json b/advisories/github-reviewed/2024/08/GHSA-r5ph-4jxm-6j9p/GHSA-r5ph-4jxm-6j9p.json new file mode 100644 index 00000000000..5bbe20b1b6d --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-r5ph-4jxm-6j9p/GHSA-r5ph-4jxm-6j9p.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r5ph-4jxm-6j9p", + "modified": "2024-08-20T20:04:31Z", + "published": "2024-08-20T20:04:31Z", + "aliases": [ + "CVE-2024-43406" + ], + "summary": "LF Edge eKuiper has a SQL Injection in sqlKvStore", + "details": "### Summary\nA user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. \n\n### Details\nI will use explainRuleHandler (\"/rules/{name}/explain\") as an example to illustrate. However, this vulnerability also exists in other methods such as sourceManageHandler, asyncTaskCancelHandler, pluginHandler, etc.\n\nThe SQL injection can happen in the code:\nhttps://github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/pkg/store/sql/sqlKv.go#L89-L93\nThe code to accept user input is:\nhttps://github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/server/rest.go#L274-L277\n\nThe rule id in the above code can be used to exploit SQL query.\n\nNote that the delete function is also vulnerable:\nhttps://github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/pkg/store/sql/sqlKv.go#L138-L141\n\n### PoC\n```\nimport requests\nfrom urllib.parse import quote\n\n# SELECT val FROM 'xxx' WHERE key='%s';\npayload = f\"\"\"'; ATTACH DATABASE 'test93' AS test93;\nCREATE TABLE test93.pwn (dataz text);\nINSERT INTO test93.pwn (dataz) VALUES (\"sql injection\");--\"\"\"\n\n#payload = \"deadbeef'; SELECT 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(100000000))));--\"\n\nurl = f\"http://127.0.0.1:9081/rules/{quote(payload,safe='')}/explain\" # explainRuleHandler\n\nres = requests.get(url)\nprint(res.content)\n```\n\nThe screenshot shows the malicious SQL query to insert a value:\n![image](https://github.com/user-attachments/assets/baf035cc-a561-4909-8d1f-e455e75375cb)\n\nThe screenshot shows the breakpoint of executing the query:\n![image](https://github.com/user-attachments/assets/b9c29945-a0cc-4271-bdc8-c1bddfda5b6f)\n\n\n\n\n### Impact\nSQL Injection vulnerability\n\nThe reporters are Yuan Luo, Shuai Xiong, Haoyu Wang from Tencent YunDing Security Lab.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/lf-edge/ekuiper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.14.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43406" + }, + { + "type": "WEB", + "url": "https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lf-edge/ekuiper" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T20:04:31Z", + "nvd_published_at": "2024-08-20T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-hh8p-374f-qgr5/GHSA-hh8p-374f-qgr5.json b/advisories/unreviewed/2024/08/GHSA-hh8p-374f-qgr5/GHSA-hh8p-374f-qgr5.json deleted file mode 100644 index 0c2a3592d9d..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-hh8p-374f-qgr5/GHSA-hh8p-374f-qgr5.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hh8p-374f-qgr5", - "modified": "2024-08-20T18:31:26Z", - "published": "2024-08-20T18:31:26Z", - "aliases": [ - "CVE-2024-6322" - ], - "details": "Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6322" - }, - { - "type": "WEB", - "url": "https://grafana.com/security/security-advisories/cve-2024-6322" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-266" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-20T18:15:09Z" - } -} \ No newline at end of file