From 9b252dcc794fd7758fe29399e753d24a7770130e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 5 Feb 2024 20:21:04 +0000 Subject: [PATCH] Publish Advisories GHSA-6648-6g96-mg35 GHSA-9xfw-jjq2-7v8h GHSA-mpwj-fcr6-x34c --- .../GHSA-6648-6g96-mg35.json | 65 +++++++++++++++++ .../GHSA-9xfw-jjq2-7v8h.json | 72 +++++++++++++++++++ .../GHSA-mpwj-fcr6-x34c.json | 31 ++++++-- 3 files changed, 164 insertions(+), 4 deletions(-) create mode 100644 advisories/github-reviewed/2024/02/GHSA-6648-6g96-mg35/GHSA-6648-6g96-mg35.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-9xfw-jjq2-7v8h/GHSA-9xfw-jjq2-7v8h.json rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json (67%) diff --git a/advisories/github-reviewed/2024/02/GHSA-6648-6g96-mg35/GHSA-6648-6g96-mg35.json b/advisories/github-reviewed/2024/02/GHSA-6648-6g96-mg35/GHSA-6648-6g96-mg35.json new file mode 100644 index 00000000000..8bd3495eb62 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-6648-6g96-mg35/GHSA-6648-6g96-mg35.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6648-6g96-mg35", + "modified": "2024-02-05T20:20:40Z", + "published": "2024-02-05T20:20:40Z", + "aliases": [ + "CVE-2024-22202" + ], + "summary": "phpMyFAQ User Removal Page Allows Spoofing Of User Details", + "details": "### Summary\nphpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account.\n\n### Details\nphpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. Whilst the front-end of this page doesn't allow changing the form details, an attacker can utilize a proxy to intercept this request and submit other data. Upon submitting this form, an email is sent to the administrator informing them that this user wants to delete their account. An administrator has no way of telling the difference between the actual user wishing to delete their account or the attacker issuing this for an account they do not control.\n\n### PoC\nWe are logged in as `hacker` and visit `/user/request-removal`. This brings us to the following page. We are not able to change the `username`, `Your name` and `Your email address` fields on this page.\n![image](https://user-images.githubusercontent.com/44903767/296202382-9e6d6409-3ffb-4983-8895-9903e7dfc663.png)\n\nHowever, we intercept this request using a proxy tool such as BurpSuite.\n![image](https://user-images.githubusercontent.com/44903767/296202522-dd80fe87-e7b7-4fe2-97be-dca03289f506.png)\n\nWe can now edit the request before sending it. We change the fields mentioned above to the details of another user, and send the request.\n![image](https://user-images.githubusercontent.com/44903767/296202705-fa8fd3f8-1417-457e-9d6e-7e4ba0f8744a.png)\n\nThis results in the following email being sent to the administrator. For them, it looks like the victim wants to delete their account.\n![image](https://user-images.githubusercontent.com/44903767/296202935-a5c48e0b-f93e-488a-9716-4f93889100a7.png)\n\n### Impact\nThe impact of this vulnerability is that administrators cannot trust the emails sent by the platform. An attacker can easily make a compelling case to perform phishing and get victim accounts deleted.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyfaq/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6648-6g96-mg35" + }, + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/commit/1348dcecdaec5a5714ad567c16429432417b534d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thorsten/phpMyFAQ" + }, + { + "type": "WEB", + "url": "https://www.phpmyfaq.de/security/advisory-2024-02-05" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-05T20:20:40Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-9xfw-jjq2-7v8h/GHSA-9xfw-jjq2-7v8h.json b/advisories/github-reviewed/2024/02/GHSA-9xfw-jjq2-7v8h/GHSA-9xfw-jjq2-7v8h.json new file mode 100644 index 00000000000..2a6d872e6e4 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-9xfw-jjq2-7v8h/GHSA-9xfw-jjq2-7v8h.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9xfw-jjq2-7v8h", + "modified": "2024-02-05T20:19:30Z", + "published": "2024-02-05T20:19:30Z", + "aliases": [ + "CVE-2024-24768" + ], + "summary": "1Panel set-cookie is missing the Secure keyword", + "details": "### Summary\nThe https cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text when accessing http accidentally.\n\nhttps://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Set-Cookie#secure\n\n### PoC\nDirectly configure https for the panel, and then capture the packet when logging in again and find that the cookie does not have the Secure keyword\n\n### Impact\nEveryone who has configured the panel https\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/1Panel-dev/1Panel" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.9.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.9.5" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-jjq2-7v8h" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24768" + }, + { + "type": "WEB", + "url": "https://github.com/1Panel-dev/1Panel/pull/3817" + }, + { + "type": "WEB", + "url": "https://github.com/1Panel-dev/1Panel/commit/1169648162c4b9b48e0b4aa508f9dea4d6bc50d5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/1Panel-dev/1Panel" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-315" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-05T20:19:30Z", + "nvd_published_at": "2024-02-05T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json b/advisories/github-reviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json similarity index 67% rename from advisories/unreviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json rename to advisories/github-reviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json index 827877e682a..35a76b8e6be 100644 --- a/advisories/unreviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json +++ b/advisories/github-reviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mpwj-fcr6-x34c", - "modified": "2024-02-04T21:30:43Z", + "modified": "2024-02-05T20:20:29Z", "published": "2024-02-04T21:30:43Z", "aliases": [ "CVE-2021-4435" ], + "summary": "Yarn untrusted search path vulnerability", "details": "An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "yarn" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.22.13" + } + ] + } + ] + } ], "references": [ { @@ -33,6 +52,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262284" }, + { + "type": "PACKAGE", + "url": "https://github.com/yarnpkg/yarn" + }, { "type": "WEB", "url": "https://github.com/yarnpkg/yarn/releases/tag/v1.22.13" @@ -43,8 +66,8 @@ "CWE-426" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-05T20:20:29Z", "nvd_published_at": "2024-02-04T20:15:45Z" } } \ No newline at end of file