netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-mm6v-68qp-f9fw

Browse Source
This commit is contained in:
advisory-database[bot]
2025-02-12 20:53:09 +00:00
parent 941c1cb9e7
commit b38eaeb1dd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json
+2 -2
View File
@@ -1,11 +1,11 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mm6v-68qp-f9fw",
"modified": "2025-01-15T22:04:19Z",
"modified": "2025-02-12T20:51:44Z",
"published": "2025-01-15T22:04:19Z",
"aliases": [],
"summary": "Crayfish allows Remote Code Execution via Homarus Authorization header",
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n_Are there any links users can visit to find out more?_\n\n- XBOW-024-071",
"details": "### Impact\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n\nThe exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n\n- XBOW-024-071",
"severity": [
{
"type": "CVSS_V3",