From 8e65a670dba724ccf1d96bff7ef639e38d6daf11 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Feb 2025 20:17:56 +0000 Subject: [PATCH] Publish Advisories GHSA-j3mm-wmfm-mwvh GHSA-rr6p-3pfg-562j --- .../GHSA-j3mm-wmfm-mwvh.json | 87 ++++++++++++++++++ .../GHSA-rr6p-3pfg-562j.json | 92 +++++++++++++++++++ 2 files changed, 179 insertions(+) create mode 100644 advisories/github-reviewed/2025/02/GHSA-j3mm-wmfm-mwvh/GHSA-j3mm-wmfm-mwvh.json create mode 100644 advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json diff --git a/advisories/github-reviewed/2025/02/GHSA-j3mm-wmfm-mwvh/GHSA-j3mm-wmfm-mwvh.json b/advisories/github-reviewed/2025/02/GHSA-j3mm-wmfm-mwvh/GHSA-j3mm-wmfm-mwvh.json new file mode 100644 index 00000000000..63d4f586848 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-j3mm-wmfm-mwvh/GHSA-j3mm-wmfm-mwvh.json @@ -0,0 +1,87 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j3mm-wmfm-mwvh", + "modified": "2025-02-20T20:16:31Z", + "published": "2025-02-20T20:16:31Z", + "aliases": [ + "CVE-2025-25299" + ], + "summary": "Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package", + "details": "### Impact\nDuring a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized JavaScript code execution and affects user markers, which represent users' positions within the document.\n\nThis vulnerability affects only installations with [Real-time collaborative editing](https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html) enabled.\n\n### Patches\nThe problem has been recognized and patched. The fix will be available in version 44.2.1 (and above).\n\n### For more information\nEmail us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@ckeditor/ckeditor5-real-time-collaboration" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "41.3.0" + }, + { + "fixed": "44.2.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 44.2.0" + } + }, + { + "package": { + "ecosystem": "npm", + "name": "ckeditor5-premium-features" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.0.0" + }, + { + "fixed": "44.2.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 44.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-j3mm-wmfm-mwvh" + }, + { + "type": "WEB", + "url": "https://ckeditor.com/docs/ckeditor5/latest/features/collaboration/real-time-collaboration/real-time-collaboration.html?docId=ee1dca024c9b4e44aef039f99ebe6c664" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ckeditor/ckeditor5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79", + "CWE-80" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-20T20:16:31Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json b/advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json new file mode 100644 index 00000000000..dad5d71db92 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-rr6p-3pfg-562j/GHSA-rr6p-3pfg-562j.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rr6p-3pfg-562j", + "modified": "2025-02-20T20:16:21Z", + "published": "2025-02-20T20:16:21Z", + "aliases": [ + "CVE-2025-24893" + ], + "summary": "XWiki Platform allows remote code execution as guest via SolrSearchMacros request", + "details": "### Impact\nAny guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce on an instance, without being logged in, go to `/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28\"Hello%20from\"%20%2B%20\"%20search%20text%3A\"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable.\n\n### Patches\nThis vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1.\n\n### Workarounds\n[This line](https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955) in `Main.SolrSearchMacros` can be edited to match the `rawResponse` macro defined [here](https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824) with a content type of `application/xml`, instead of simply outputting the content of the feed.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-22149\n* https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40\n\n### Attribution\nThis vulnerability has been reported by John Kwak for Trend Micro's Zero Day Initiative.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-search-solr-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.3-milestone-2" + }, + { + "fixed": "15.10.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-search-solr-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.0.0-rc-1" + }, + { + "fixed": "16.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki/xwiki-platform" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/blob/67021db9b8ed26c2236a653269302a86bf01ef40/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/macros.vm#L2824" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/XWIKI-22149" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-95" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-20T20:16:21Z", + "nvd_published_at": null + } +} \ No newline at end of file