From 9905ac0af849cf6d68b5232e900fdf9ac0965eff Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 26 Sep 2024 21:13:51 +0000 Subject: [PATCH] Publish Advisories GHSA-gcx4-mw62-g8wm GHSA-h4h5-9833-v2p4 --- .../GHSA-gcx4-mw62-g8wm.json | 25 ++++- .../GHSA-h4h5-9833-v2p4.json | 103 ++++++++++++++++++ 2 files changed, 125 insertions(+), 3 deletions(-) create mode 100644 advisories/github-reviewed/2024/09/GHSA-h4h5-9833-v2p4/GHSA-h4h5-9833-v2p4.json diff --git a/advisories/github-reviewed/2024/09/GHSA-gcx4-mw62-g8wm/GHSA-gcx4-mw62-g8wm.json b/advisories/github-reviewed/2024/09/GHSA-gcx4-mw62-g8wm/GHSA-gcx4-mw62-g8wm.json index 4f100763f6f..c802cc86c12 100644 --- a/advisories/github-reviewed/2024/09/GHSA-gcx4-mw62-g8wm/GHSA-gcx4-mw62-g8wm.json +++ b/advisories/github-reviewed/2024/09/GHSA-gcx4-mw62-g8wm/GHSA-gcx4-mw62-g8wm.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-gcx4-mw62-g8wm", - "modified": "2024-09-23T22:11:02Z", + "modified": "2024-09-26T21:11:53Z", "published": "2024-09-23T22:11:02Z", "aliases": [ "CVE-2024-47068" ], "summary": "DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS", - "details": "### Summary\n\nA DOM Clobbering vulnerability was discovered in rollup when bundling scripts that use `import.meta.url` or with plugins that emit and reference asset files from code in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present.\n\nIt's worth noting that similar issues in other popular bundlers like Webpack ([CVE-2024-43788](https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986)) have been reported, which might serve as a good reference.\n\n### Details\n\n#### Backgrounds\n\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] https://scnps.co/papers/sp23_domclob.pdf\n[2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/\n\n#### Gadget found in `rollup`\n\nA DOM Clobbering vulnerability in `rollup` bundled scripts was identified, particularly when the scripts uses `import.meta` and set output in format of `cjs`/`umd`/`iife`. In such cases, `rollup` replaces meta property with the URL retrieved from `document.currentScript`.\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185\n\nHowever, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the `src` attribute of the attacker-controlled element (e.g., an `img` tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.\n\n### PoC\n\nConsidering a website that contains the following `main.js` script, the devloper decides to use the `rollup` to bundle up the program: `rollup main.js --format cjs --file bundle.js`.\n\n```\nvar s = document.createElement('script')\ns.src = import.meta.url + 'extra.js'\ndocument.head.append(s)\n```\n\nThe output `bundle.js` is shown in the following code snippet.\n\n```\n'use strict';\n\nvar _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;\nvar s = document.createElement('script');\ns.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';\ndocument.head.append(s);\n```\n\nAdding the `rollup` bundled script, `bundle.js`, as part of the web page source code, the page could load the `extra.js` file from the attacker's domain, `attacker.controlled.server` due to the introduced gadget during bundling. The attacker only needs to insert an `img` tag with the name attribute set to `currentScript`. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n\n```\n\n\n\n rollup Example\n \n \n \n\n\n\n\n\n```\n\n### Impact\n\nThis vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of `cjs`, `iife`, or `umd` and use `import.meta`) and allow users to inject certain scriptless HTML tags without properly sanitizing the `name` or `id` attributes.\n\n### Patch\n\nPatching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.\n\n```\nconst getRelativeUrlFromDocument = (relativePath: string, umd = false) =>\n\tgetResolveUrl(\n\t\t`'${escapeId(relativePath)}', ${\n\t\t\tumd ? `typeof document === 'undefined' ? location.href : ` : ''\n\t\t}document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`\n\t);\n```\n\n```\nconst getUrlFromDocument = (chunkId: string, umd = false) =>\n\t`${\n\t\tumd ? `typeof document === 'undefined' ? location.href : ` : ''\n\t}(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(\n\t\tchunkId\n\t)}', document.baseURI).href)`;\n```\n", + "details": "### Summary\n\nWe discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use `import.meta.url` or with plugins that emit and reference asset files from code in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present.\n\nIt's worth noting that we’ve identifed similar issues in other popular bundlers like Webpack ([CVE-2024-43788](https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986)), which might serve as a good reference.\n\n### Details\n\n#### Backgrounds\n\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] https://scnps.co/papers/sp23_domclob.pdf\n[2] https://research.securitum.com/xss-in-amp4email-dom-clobbering/\n\n#### Gadget found in `rollup`\n\nWe have identified a DOM Clobbering vulnerability in `rollup` bundled scripts, particularly when the scripts uses `import.meta` and set output in format of `cjs`/`umd`/`iife`. In such cases, `rollup` replaces meta property with the URL retrieved from `document.currentScript`.\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162\n\nhttps://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185\n\nHowever, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the `src` attribute of the attacker-controlled element (e.g., an `img` tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.\n\n### PoC\n\nConsidering a website that contains the following `main.js` script, the devloper decides to use the `rollup` to bundle up the program: `rollup main.js --format cjs --file bundle.js`.\n\n```\nvar s = document.createElement('script')\ns.src = import.meta.url + 'extra.js'\ndocument.head.append(s)\n```\n\nThe output `bundle.js` is shown in the following code snippet.\n\n```\n'use strict';\n\nvar _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;\nvar s = document.createElement('script');\ns.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';\ndocument.head.append(s);\n```\n\nAdding the `rollup` bundled script, `bundle.js`, as part of the web page source code, the page could load the `extra.js` file from the attacker's domain, `attacker.controlled.server` due to the introduced gadget during bundling. The attacker only needs to insert an `img` tag with the name attribute set to `currentScript`. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n\n```\n\n\n\n rollup Example\n \n \n \n\n\n\n\n\n```\n\n### Impact\n\nThis vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of `cjs`, `iife`, or `umd` and use `import.meta`) and allow users to inject certain scriptless HTML tags without properly sanitizing the `name` or `id` attributes.\n\n### Patch\n\nPatching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.\n\n```\nconst getRelativeUrlFromDocument = (relativePath: string, umd = false) =>\n\tgetResolveUrl(\n\t\t`'${escapeId(relativePath)}', ${\n\t\t\tumd ? `typeof document === 'undefined' ? location.href : ` : ''\n\t\t}document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`\n\t);\n```\n\n```\nconst getUrlFromDocument = (chunkId: string, umd = false) =>\n\t`${\n\t\tumd ? `typeof document === 'undefined' ? location.href : ` : ''\n\t}(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(\n\t\tchunkId\n\t)}', document.baseURI).href)`;\n```\n", "severity": [ { "type": "CVSS_V3", @@ -29,7 +29,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "3.0.0" }, { "fixed": "3.29.5" @@ -56,6 +56,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "npm", + "name": "rollup" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.79.2" + } + ] + } + ] } ], "references": [ diff --git a/advisories/github-reviewed/2024/09/GHSA-h4h5-9833-v2p4/GHSA-h4h5-9833-v2p4.json b/advisories/github-reviewed/2024/09/GHSA-h4h5-9833-v2p4/GHSA-h4h5-9833-v2p4.json new file mode 100644 index 00000000000..31975885fb2 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-h4h5-9833-v2p4/GHSA-h4h5-9833-v2p4.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h4h5-9833-v2p4", + "modified": "2024-09-26T21:13:08Z", + "published": "2024-09-26T21:13:08Z", + "aliases": [ + "CVE-2024-22030" + ], + "summary": "Rancher agents can be hijacked by taking over the Rancher Server URL", + "details": "### Impact\nA vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL.\n\nSUSE is unaware of any successful exploitation of this vulnerability, which has a high complexity bar. \n\nPlease consult the associated [MITRE ATT&CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this attack category.\n\n### Patches\nA new setting, [`agent-tls-mode`](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/tls-settings), was added, which allows users to specify if agents will use `strict` certificate verification when connecting to Rancher. The field can be set to `strict` (which requires the agent to verify the certificate using only the Certificate Authority in the `cacerts` setting) or `system-store` (which allows the agent to verify the certificate using any Certificate Authority in the operating system's trust store). This setting will default to strict on new installs of Rancher `v2.8.6`, `v2.9.0`, and newer versions. When upgrading from a prior version, the current value will be kept. If updating from older versions, the settings must be manually configured.\n\n**Important:** For non-Windows nodes, this is fixed since `v2.8.6` and `v2.9.0`. For Windows nodes, this is fully fixed starting with `v2.8.8` and `v2.9.2`\n\nPatched versions include releases `v2.8.8` and `v2.9.2`.\n\nFor non-Windows nodes, the fix was released with `v2.7.15`. However, if you are running Rancher `v2.7.x` and have Windows nodes, you must follow the below workaround to address this issue on those nodes.\n\n### Workarounds\nIf you can't update, please follow the standard security practices including:\n \n1. Properly control the expiration and ownership of the domain used as the Rancher URL (the `server-url` of the Rancher cluster).\n2. Enabling DNSSEC as a way to protect against DNS spoofing or hijacking attacks. \n3. Properly clean up and decommission unused clusters and downstream clusters, instead of leaving them behind. For example, downstream clusters which are alive while the main Rancher server is no longer available.\n\nIn some cases, Windows nodes added to RKE2 clusters may not be automatically updated with the desired `agent-tls-mode`. Windows clusters running at least the August patches (`v1.27.16`, `v1.28.13`, `v1.29.8`, `v1.30.4`) will be automatically updated. For Windows nodes running older versions of RKE2, this issue can be manually resolved by following these [instructions](https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify).\n\nIf you are running Rancher `v2.7.x` Windows nodes will not automatically update, and you must follow the above [instructions](https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify), with the following notes:\n1. This needs to be done for all existing Windows nodes and any new nodes provisioned.\n2. You must omit the `DownloadWins` flag, and must instead manually download the `rancher-wins` version [0.4.18](https://github.com/rancher/wins/releases/tag/v0.4.18), or greater, from its GitHub repository and place it in the required directories:\na. `c:\\Windows`\nb. `c:\\user\\local\\bin`\n3. You must restart the nodes after running the script, simply restarting `rancher-wins` or RKE2 will result in [pod networking errors](https://github.com/rancher/rke2/issues/5551). The only scenario where you do not need to completely restart the node is if the cluster is running version `v1.27.16` or higher.\n\n### Credits\nThis issue was found and reported by Jarkko Vesiluoma from Redtest Security.\n\n### For more information\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7.0" + }, + { + "fixed": "2.7.15" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/rancher" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/rancher/rancher/security/advisories/GHSA-h4h5-9833-v2p4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/rancher/rancher" + }, + { + "type": "WEB", + "url": "https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify" + }, + { + "type": "WEB", + "url": "https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/tls-settings" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-26T21:13:08Z", + "nvd_published_at": null + } +} \ No newline at end of file