diff --git a/advisories/github-reviewed/2024/06/GHSA-c2g2-gx4j-rj3j/GHSA-c2g2-gx4j-rj3j.json b/advisories/github-reviewed/2024/06/GHSA-c2g2-gx4j-rj3j/GHSA-c2g2-gx4j-rj3j.json new file mode 100644 index 00000000000..fa714021038 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-c2g2-gx4j-rj3j/GHSA-c2g2-gx4j-rj3j.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c2g2-gx4j-rj3j", + "modified": "2024-06-02T22:28:09Z", + "published": "2024-06-02T22:28:09Z", + "aliases": [ + "CVE-2024-35196" + ], + "summary": "Slack integration leaks sensitive information in logs", + "details": "### Impact\nSentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the [deprecated Slack verification token](https://api.slack.com/authentication/verifying-requests-from-slack#deprecation). With this verification token, it is possible under specific configurations, an attacker can forge requests and act as the Slack integration.\n\nThe request body is leaked in log entries matching `event == \"slack.*\" && name == \"sentry.integrations.slack\" && request_data == *`. The deprecated slack verification token, will be found in the `request_data.token` key.\n\nExample event:\n\n```json\n{\n \"name\": \"sentry.integrations.slack\",\n \"level\": \"info\",\n \"event\": \"slack.event.message\", # This could be any of the `slack.*` events\n \"request_data\": {\n # Other keys are omitted for brevity\n \"token\": \"\",\n }\n}\n``` \n\n### Patches\n- **SaaS users** do not need to take any action.\n- **Self-hosted users** should upgrade to version 24.5.0 or higher, [rotate their Slack verification token](https://api.slack.com/authentication/verifying-requests-from-slack#regenerating), and [use the Slack Signing Secret instead of the verification token](https://develop.sentry.dev/integrations/slack/).\n - If you are only using the `slack.signing-secret` in your self-hosted configuration, then the legacy verification token is not used to verify the webhook payload. It is ignored. \n \n> ⚠️ Sentry's support for validating Slack requests via the legacy verification token will be deprecated in version 24.7.0.\n\n\n### Workarounds\n\n#### Option 1\n\nSet the `slack.signing-secret` instead of `slack.verification-token`. The [signing secret](https://api.slack.com/authentication/verifying-requests-from-slack#app-management-updates) is Slack's recommended way of authenticating webhooks.\n\nBy having `slack.singing-secret` set, Sentry self-hosted will no longer use the verification token for authentication of the webhooks, regardless of whether `slack.verification-token` is set or not.\n\n#### Option 2\n\nThe deprecated Slack verification token is leaked in log levels of `INFO` and `ERROR` in the Slack integration. If the self-hosted instance is unable to be upgraded or re-configured to use the `slack.signing-secret`, the logging configuration can be adjusted to not generate logs from the integration. The [default logging configuration can be found in `src/sentry/conf/server.py`](https://github.com/getsentry/sentry/blob/17d2b87e39ccd57e11da4deed62971ff306253d1/src/sentry/conf/server.py#L1307). **Services should be restarted once the configuration change is saved.**\n\nBelow you'll find an example of the configuration adjustments necessary to remove the Slack integration logs:\n \n```python\n# src/sentry/conf/server.py\n\n...\n \nLOGGING: LoggingConfig = {\n ...\n handlers: {\n # the line below already exists in the default configuration\n \"null\": {\"class\": \"logging.NullHandler\"},\n ...\n },\n \"loggers\": {\n \"sentry.integrations.slack\": {\n \"handlers\": [\"null\"], # route logs to null handler\n \"level\": \"CRITICAL\", # prevent generation of logs a lower levels (ex. ERROR and INFO)\n },\n ...\n },\n}\n```\n\n### References\n- https://github.com/getsentry/sentry/pull/70508\n- [Sentry Slack Integration Documentation for Self-Hosted users](https://develop.sentry.dev/integrations/slack/)\n- [Documentation on Slack Signing Secrets](https://api.slack.com/authentication/verifying-requests-from-slack#app-management-updates)\n- [Slack Deprecation for Verification Tokens](https://api.slack.com/authentication/verifying-requests-from-slack#deprecation)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "sentry" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "24.3.0" + }, + { + "fixed": "24.5.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-c2g2-gx4j-rj3j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35196" + }, + { + "type": "WEB", + "url": "https://github.com/getsentry/sentry/pull/70508" + }, + { + "type": "WEB", + "url": "https://api.slack.com/authentication/verifying-requests-from-slack#app-management-updates" + }, + { + "type": "WEB", + "url": "https://api.slack.com/authentication/verifying-requests-from-slack#deprecation" + }, + { + "type": "WEB", + "url": "https://api.slack.com/authentication/verifying-requests-from-slack#regenerating" + }, + { + "type": "WEB", + "url": "https://develop.sentry.dev/integrations/slack" + }, + { + "type": "PACKAGE", + "url": "https://github.com/getsentry/sentry" + }, + { + "type": "WEB", + "url": "https://github.com/getsentry/sentry/blob/17d2b87e39ccd57e11da4deed62971ff306253d1/src/sentry/conf/server.py#L1307" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:28:09Z", + "nvd_published_at": "2024-05-31T18:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-qg5r-95m4-mjgj/GHSA-qg5r-95m4-mjgj.json b/advisories/github-reviewed/2024/06/GHSA-qg5r-95m4-mjgj/GHSA-qg5r-95m4-mjgj.json new file mode 100644 index 00000000000..130393322f1 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-qg5r-95m4-mjgj/GHSA-qg5r-95m4-mjgj.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qg5r-95m4-mjgj", + "modified": "2024-06-02T22:27:54Z", + "published": "2024-06-02T22:27:54Z", + "aliases": [ + "CVE-2024-32877" + ], + "summary": "Reflected Cross-site Scripting in yiisoft/yii2 Debug mode", + "details": "During the internal penetration testing of our product based on Yii2, we discovered an XSS vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3).\n\n### Conditions for vulnerability reproduction\n\n* The framework is in debug mode (YII_DEBUG set to true).\n* The php.ini setting zend.exception_ignore_args is set to Off (default value).\n* An attacker induces an exception in the application, leading to a stack trace page being displayed.\n\n### Vulnerability description\n\nThe issue lies in the mechanism for displaying function argument values in the stack trace. The vulnerability manifests when an argument's value exceeds 32 characters. For convenience, argument values exceeding this limit are truncated and displayed with an added \"...\". The full argument value becomes visible when hovering over it with the mouse, as it is displayed in the title attribute of a span tag. However, the use of a double quote (\") allows an attacker to break out of the title attribute's value context and inject their own attributes into the span tag, including malicious JavaScript code through event handlers such as onmousemove.\n\nDemonstration example:\nhttp://31.184.254.143/about/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%22%20onmousemove=alert(1)%20style=%22width:%20100000px;%20height:%20100000px;%20position:%20absolute;%20top:%20-10000px;%20left:%200;%22\n\n### Impact of the vulnerability\n\nThis vulnerability allows an attacker to execute arbitrary JavaScript code in the security context of the victim's site via a specially crafted link. This could lead to the theft of cookies (including httpOnly cookies, which are accessible on the page), content substitution, or complete takeover of user accounts.\n\n### Technical analysis and mitigation suggestion\n\nUpon analyzing the framework's source code, it was found that data handling for the title attribute is performed in the file framework/web/ErrorHandler.php. The identified problem is related to changes made in the commit https://github.com/yiisoft/yii2/commit/8cc9aeb2f0b2ffe02fb54a817064e9da75512706 , which led to the disabling of encoding for single and double quotes in the htmlEncode method (https://github.com/yiisoft/yii2/blob/8cc9aeb2f0b2ffe02fb54a817064e9da75512706/framework/web/ErrorHandler.php#L183) due to the addition of the ENT_NOQUOTES flag. To address this issue while preserving the functionality intended by the commit, we suggest modifying the htmlEncode method as follows:\n\n return htmlspecialchars($text, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5, 'UTF-8');\n\nThis change will effectively prevent the XSS vulnerability while maintaining the targeted functionality of the previous changes.\n\n\n### Conclusion\n\nBased on the above, we strongly recommend implementing the suggested changes to the project's main code as soon as possible to protect framework users from potential attacks. I am ready to provide further information or assistance, including creating a pull request if necessary.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "yiisoft/yii2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.49.3" + }, + { + "fixed": "2.0.50" + } + ] + } + ], + "versions": [ + "2.0.49.3" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/yiisoft/yii2/security/advisories/GHSA-qg5r-95m4-mjgj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32877" + }, + { + "type": "WEB", + "url": "https://github.com/yiisoft/yii2/commit/f7baab16e79f2369d4838ab5653c3c07ecf26615" + }, + { + "type": "PACKAGE", + "url": "https://github.com/yiisoft/yii2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:27:54Z", + "nvd_published_at": "2024-05-30T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-rcvg-jj3g-rj7c/GHSA-rcvg-jj3g-rj7c.json b/advisories/github-reviewed/2024/06/GHSA-rcvg-jj3g-rj7c/GHSA-rcvg-jj3g-rj7c.json new file mode 100644 index 00000000000..80d2f55a348 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-rcvg-jj3g-rj7c/GHSA-rcvg-jj3g-rj7c.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcvg-jj3g-rj7c", + "modified": "2024-06-02T22:28:03Z", + "published": "2024-06-02T22:28:03Z", + "aliases": [ + "CVE-2024-35189" + ], + "summary": "Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints", + "details": "The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. \n\nFides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `\"**********\"` placeholder value.\n\nThis vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs.\n\nConnection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability.\n\n\n### Impact\n\nThe Google Cloud secrets used for a Fides BigQuery integration may be retrieved in plaintext by any authenticated Admin UI user, except those with the Approver role. Any API users authorized to access the following endpoints may also retrieve the key in plaintext.\n\nEndpoints impacted:\n- `GET /api/v1/connections`\n- `PATCH /api/v1/connections`\n- `GET /api/v1/connection/{connection_key}`\n- `PATCH /api/v1/system/{system_key}/connection`\n- `GET /api/v1/system/{system_key}`\n- `GET /api/v1/system/{system_key}/connection`\n\nConnection config secret schemas impacted:\n- `BigQuerySchema`\n\n### Patches\nThe vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.\n\nUsers are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments: https://cloud.google.com/iam/docs/key-rotation\n\n### Workarounds\nThere are no workarounds.\n\n### Proof of concept\n\nMultiple endpoints are impacted, but this PoC will use `GET /api/v1/system/{system_key}` as an example.\n\n1. Using the Admin UI, navigate to `/add-systems`. Add and save a new system `bq_poc`.\n2. In the integrations tab of the new system, configure and save a BigQuery integration with secrets.\n3. Log in as a different user with any role except Approver and navigate to the `/systems` page.\n4. Open the network section of your browser's developer tools.\n5. Click on the `bq_poc` system's meatball menu and then click edit.\n6. In the network section of browser dev tools you will observe a HTTP GET http://localhost:8080/api/v1/system/bq_poc/ request. In the body of the JSON response the integration secrets values entered in Step 2 are exposed in plaintext i.e.\n\n```json\n{\n \"secrets\": {\n \"keyfile_creds\": {\n \"type\": \"value\",\n \"project_id\": \"value\",\n \"private_key_id\": \"value\",\n \"private_key\": \"value\",\n \"client_email\": \"value\",\n \"client_id\": \"value\",\n \"auth_uri\": \"value\",\n \"token_uri\": \"value\",\n \"auth_provider_x509_cert_url\": \"value\",\n \"client_x509_cert_url\": \"value\"\n }\n }\n}\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ethyca-fides" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.37.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35189" + }, + { + "type": "WEB", + "url": "https://cloud.google.com/iam/docs/key-rotation" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ethyca/fides" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:28:03Z", + "nvd_published_at": "2024-05-30T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-xxfm-vmcf-g33f/GHSA-xxfm-vmcf-g33f.json b/advisories/github-reviewed/2024/06/GHSA-xxfm-vmcf-g33f/GHSA-xxfm-vmcf-g33f.json new file mode 100644 index 00000000000..617cdbd9982 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-xxfm-vmcf-g33f/GHSA-xxfm-vmcf-g33f.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xxfm-vmcf-g33f", + "modified": "2024-06-02T22:28:28Z", + "published": "2024-06-02T22:28:28Z", + "aliases": [ + "CVE-2024-35228" + ], + "summary": "Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`", + "details": "### Impact\nDue to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected.\n\n### Workarounds\n\nNo workaround is available.\n\n### Acknowledgements\n\nMany thanks to Victor Miti for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "wagtail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.0.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "wagtail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-xxfm-vmcf-g33f" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35228" + }, + { + "type": "WEB", + "url": "https://github.com/wagtail/wagtail/commit/284f75a6f91f7ab18cc304d7d34f33b559ae37b1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/wagtail/wagtail" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-280" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:28:28Z", + "nvd_published_at": "2024-05-30T19:15:16Z" + } +} \ No newline at end of file