From ac70434eac1a799113fbe18f6d3e3013c482b8c4 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 12 Feb 2024 15:18:39 +0000
Subject: [PATCH] Publish GHSA-gccq-h3xj-jgvf

---
 .../GHSA-gccq-h3xj-jgvf.json                  | 70 +++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/02/GHSA-gccq-h3xj-jgvf/GHSA-gccq-h3xj-jgvf.json

diff --git a/advisories/github-reviewed/2024/02/GHSA-gccq-h3xj-jgvf/GHSA-gccq-h3xj-jgvf.json b/advisories/github-reviewed/2024/02/GHSA-gccq-h3xj-jgvf/GHSA-gccq-h3xj-jgvf.json
new file mode 100644
index 00000000000..5ade2ebb4ea
--- /dev/null
+++ b/advisories/github-reviewed/2024/02/GHSA-gccq-h3xj-jgvf/GHSA-gccq-h3xj-jgvf.json
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gccq-h3xj-jgvf",
+  "modified": "2024-02-12T15:17:23Z",
+  "published": "2024-02-12T15:17:23Z",
+  "aliases": [
+    "CVE-2024-25108"
+  ],
+  "summary": "Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions",
+  "details": "### Summary\n\nWhen processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server.\n\nThis vulnerability affects every version of Pixelfed between `v0.10.4` and `v0.11.9`, inclusive. A proof of concept of this vulnerability exists.\n\n### Details\n\nTBA. This advisory will be edited with more details on 2024/02/25, when admins have been given some time to update, as we think any amount of detail would make it very easy to come up with an exploit.\n\n### Impact\n\nThis vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate.\n\nSome user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "pixelfed/pixelfed"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.10.4"
+            },
+            {
+              "fixed": "0.11.11"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/pixelfed/pixelfed/security/advisories/GHSA-gccq-h3xj-jgvf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pixelfed/pixelfed/commit/7e47d6dccb0393a2e95c42813c562c854882b037"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pixelfed/pixelfed/commit/fd7f5dbb"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pixelfed/pixelfed/commit/fd7f5dbba13818f60d1c2b3ab110b499e996aa81"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/pixelfed/pixelfed"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-280",
+      "CWE-285"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-12T15:17:23Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file