diff --git a/advisories/github-reviewed/2020/07/GHSA-7xcx-6wjh-7xp2/GHSA-7xcx-6wjh-7xp2.json b/advisories/github-reviewed/2020/07/GHSA-7xcx-6wjh-7xp2/GHSA-7xcx-6wjh-7xp2.json index aecb9e53901..b12d3cea0a6 100644 --- a/advisories/github-reviewed/2020/07/GHSA-7xcx-6wjh-7xp2/GHSA-7xcx-6wjh-7xp2.json +++ b/advisories/github-reviewed/2020/07/GHSA-7xcx-6wjh-7xp2/GHSA-7xcx-6wjh-7xp2.json @@ -3,14 +3,10 @@ "id": "GHSA-7xcx-6wjh-7xp2", "modified": "2021-09-22T21:03:04Z", "published": "2020-07-13T21:34:59Z", - "aliases": [ - - ], + "aliases": [], "summary": "Command Injection in standard-version", "details": "# GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2020-111`\n\nThe [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [standard-version](https://github.com/conventional-changelog/standard-version).\n\n## Summary\n\nThe `standardVersion` function has a command injection vulnerability. Clients of the `standard-version` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.\n\n## Product\nStandard Version\n \n## Tested Version\nCommit [2f04ac8](https://github.com/conventional-changelog/standard-version/tree/2f04ac8fc1c134a1981c23a093d4eece77d0bbb9/)\n\n## Details\n\n### Issue 1: Command injection in `standardVersion`\n\nThe following proof-of-concept illustrates the vulnerability. First install Standard Version and create an empty git repo to run the PoC in:\n\n```\nnpm install standard-version\ngit init\necho \"foo\" > foo.txt # the git repo has to be non-empty\ngit add foo.txt\ngit commit -am \"initial commit\"\n```\n\nNow create a file with the following contents:\n\n```\nvar fs = require(\"fs\");\n// setting up a bit of environment\nfs.writeFileSync(\"package.json\", '{\"name\": \"foo\", \"version\": \"1.0.0\"}');\n\nconst standardVersion = require('standard-version')\n\nstandardVersion({\n noVerify: true,\n infile: 'foo.txt',\n releaseCommitMessageFormat: \"bla `touch exploit`\"\n})\n```\n\nand run it:\n\n```\nnode test.js\n```\n\nNotice that a file named `exploit` has been created.\n\nThis vulnerability is similar to command injection vulnerabilities that have been found in other Javascript libraries. Here are some examples:\n[CVE-2020-7646](https://github.com/advisories/GHSA-m8xj-5v73-3hh8),\n[CVE-2020-7614](https://github.com/advisories/GHSA-426h-24vj-qwxf),\n[CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh),\n[CVE-2019-10778](https://github.com/advisories/GHSA-4gp3-p7ph-x2jr),\n[CVE-2019-10776](https://github.com/advisories/GHSA-84cm-v6jp-gjmr),\n[CVE-2018-16462](https://github.com/advisories/GHSA-9jm3-5835-537m),\n[CVE-2018-16461](https://github.com/advisories/GHSA-7g2w-6r25-2j7p),\n[CVE-2018-16460](https://github.com/advisories/GHSA-cfhg-9x44-78h2),\n[CVE-2018-13797](https://github.com/advisories/GHSA-pp57-mqmh-44h7),\n[CVE-2018-3786](https://github.com/advisories/GHSA-c9j3-wqph-5xx9),\n[CVE-2018-3772](https://github.com/advisories/GHSA-wjr4-2jgw-hmv8),\n[CVE-2018-3746](https://github.com/advisories/GHSA-3pxp-6963-46r9),\n[CVE-2017-16100](https://github.com/advisories/GHSA-jcw8-r9xm-32c6),\n[CVE-2017-16042](https://github.com/advisories/GHSA-qh2h-chj9-jffq).\n\nWe have written a [CodeQL](https://codeql.com) query, which automatically detects this vulnerability. You can see the results of the query on the `standard-version` project [here](https://lgtm.com/query/237522640229151035/).\n\n#### Impact\n\nThis issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.\n\n#### Remediation\n\nWe recommend not using an API that can interpret a string as a shell command. For example, use [`child_process.execFile`](https://nodejs.org/api/child_process.html#child_process_child_process_execfile_file_args_options_callback) instead of [`child_process.exec`](https://nodejs.org/api/child_process.html#child_process_child_process_exec_command_options_callback).\n\n## Credit\n\nThis issue was discovered and reported by GitHub Engineer [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).\n\n## Contact\n\nYou can contact the GHSL team at `securitylab@github.com`, please include `GHSL-2020-111` in any communication regarding this issue.\n\n## Disclosure Policy\n\nThis report is subject to our [coordinated disclosure policy](https://securitylab.github.com/disclosures#policy).", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2020/07/GHSA-gm9x-q798-hmr4/GHSA-gm9x-q798-hmr4.json b/advisories/github-reviewed/2020/07/GHSA-gm9x-q798-hmr4/GHSA-gm9x-q798-hmr4.json index 803442d3c99..04605a0d915 100644 --- a/advisories/github-reviewed/2020/07/GHSA-gm9x-q798-hmr4/GHSA-gm9x-q798-hmr4.json +++ b/advisories/github-reviewed/2020/07/GHSA-gm9x-q798-hmr4/GHSA-gm9x-q798-hmr4.json @@ -3,9 +3,7 @@ "id": "GHSA-gm9x-q798-hmr4", "modified": "2021-09-23T17:26:33Z", "published": "2020-07-29T14:53:40Z", - "aliases": [ - - ], + "aliases": [], "summary": "Command Injection in git-tags-remote", "details": "All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled. \n\nThe following proof-of-concept creates a file in `/tmp`: \n```\nconst gitTagsRemote = require('git-tags-remote');\n\ngitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo \"Injection Success\" > /tmp/command-injection.test')\n.then(tags => console.log(tags));\n```", "severity": [ diff --git a/advisories/github-reviewed/2020/07/GHSA-jmqm-f2gx-4fjv/GHSA-jmqm-f2gx-4fjv.json b/advisories/github-reviewed/2020/07/GHSA-jmqm-f2gx-4fjv/GHSA-jmqm-f2gx-4fjv.json index b9589dad4a2..f645b59d4e9 100644 --- a/advisories/github-reviewed/2020/07/GHSA-jmqm-f2gx-4fjv/GHSA-jmqm-f2gx-4fjv.json +++ b/advisories/github-reviewed/2020/07/GHSA-jmqm-f2gx-4fjv/GHSA-jmqm-f2gx-4fjv.json @@ -3,9 +3,7 @@ "id": "GHSA-jmqm-f2gx-4fjv", "modified": "2021-09-22T19:00:07Z", "published": "2020-07-07T18:59:10Z", - "aliases": [ - - ], + "aliases": [], "summary": "Sensitive information exposure through logs in npm-registry-fetch", "details": "Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `://[[:]@][:][:][/]`. The password value is not redacted and is printed to stdout and also to any generated log files.", "severity": [ diff --git a/advisories/github-reviewed/2020/07/GHSA-mm44-wc5p-wqhq/GHSA-mm44-wc5p-wqhq.json b/advisories/github-reviewed/2020/07/GHSA-mm44-wc5p-wqhq/GHSA-mm44-wc5p-wqhq.json index d2246bad4a2..292a9344e2c 100644 --- a/advisories/github-reviewed/2020/07/GHSA-mm44-wc5p-wqhq/GHSA-mm44-wc5p-wqhq.json +++ b/advisories/github-reviewed/2020/07/GHSA-mm44-wc5p-wqhq/GHSA-mm44-wc5p-wqhq.json @@ -3,14 +3,10 @@ "id": "GHSA-mm44-wc5p-wqhq", "modified": "2022-01-18T23:05:18Z", "published": "2020-07-07T16:45:24Z", - "aliases": [ - - ], + "aliases": [], "summary": "Denial of service due to reference expansion in versions earlier than 4.0", "details": "### Impact\n\nThe CBOR library supports optional tags that enable CBOR objects to contain references to objects within them. Versions earlier than 4.0 resolved those references automatically. While this by itself doesn't cause much of a security problem, a denial of service can happen if those references are deeply nested and used multiple times (so that the same reference to the same object occurs multiple times), and if the decoded CBOR object is sent to a serialization method such as EncodeToBytes, ToString, or ToJSONString, since the objects referred to are expanded in the process and take up orders of magnitude more memory than if the references weren't resolved.\n\nThe impact of this problem on any particular system varies. In general, the risk is higher if the system allows users to send arbitrary CBOR objects without authentication, or exposes a remote endpoint in which arbitrary CBOR objects can be sent without authentication.\n\n### Patches\n\nThis problem is addressed in version 4.0 by disabling reference resolution by default. Users should use the latest version of this library.\n\n### Workarounds\n\nSince version 3.6, an encoding option (`resolvereferences=true` or `resolvereferences=false`) in CBOREncodeOptions sets whether the CBOR processor will resolve these kinds of references when decoding a CBOR object. Set `resolvereferences=false` to disable reference resolution.\n\nIn version 3.6, if the method used CBORObject.Read() or CBORObject.DecodeFromBytes() to decode a serialized CBOR object, call the overload that takes CBOREncodeOptions as follows:\n\n CBORObject.DecodeFromBytes(bytes, new CBOREncodeOptions(\"resolvereferences=false\"));\n\nIn versions 3.5 and earlier, this issue is present only if the CBOR object is an array or a map. If the application does not expect a decoded CBOR object to be an array or a map, it should check the CBOR object's type before encoding that object, as follows:\n\n if (cbor.Type != CBORType.Array && cbor.Type != CBORType.Map) {\n cbor.EncodeToBytes();\n }\n\nAlternatively, for such versions, the application can use WriteTo to decode the CBOR object to a so-called \"limited memory stream\", that is, a Stream that throws an exception if too many bytes would be written. How to write such a limited-memory stream is nontrivial and beyond the scope of this advisory.\n\n LimitedMemoryStream stream = new LimitedMemoryStream(100000); // Limit to 100000 bytes\n cbor.WriteTo(stream);\n return stream.ToBytes();\n\nTo check whether a byte array representing a CBOR object might exhibit this problem, check whether the array contains the byte 0xd8 followed immediately by either 0x19 or 0x1d. This check catches all affected CBOR objects but may catch some non-affected CBOR objects (notably integers and byte strings).\n\n### References\n\nSee the Wikipedia article [Billion laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack) and the related issue in [Kubernetes](https://github.com/kubernetes/kubernetes/issues/83253).\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [the CBOR repository](https://github.com/peteroupc/cbor-java).\n", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -43,9 +39,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-07-07T16:45:07Z", diff --git a/advisories/github-reviewed/2020/07/GHSA-wvh7-5p38-2qfc/GHSA-wvh7-5p38-2qfc.json b/advisories/github-reviewed/2020/07/GHSA-wvh7-5p38-2qfc/GHSA-wvh7-5p38-2qfc.json index ba79726b887..7931ff33d97 100644 --- a/advisories/github-reviewed/2020/07/GHSA-wvh7-5p38-2qfc/GHSA-wvh7-5p38-2qfc.json +++ b/advisories/github-reviewed/2020/07/GHSA-wvh7-5p38-2qfc/GHSA-wvh7-5p38-2qfc.json @@ -3,14 +3,10 @@ "id": "GHSA-wvh7-5p38-2qfc", "modified": "2021-09-22T21:05:43Z", "published": "2020-07-23T18:20:10Z", - "aliases": [ - - ], + "aliases": [], "summary": "Storing Password in Local Storage", "details": "The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users > Signing Up, it clearly states, \"We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext.\"\n\nExample Code:\n```js\nasync () => {\n const user = Parse.User.current()\n if (user) {\n user.setPassword('newpass')\n await user.save()\n }\n}\n```\nAfter running the above code, the new password will be stored in localStorage as a property named \"password\".\n\nProposed Solution:\nBefore saving anything to localStorage, Parse should strip out any properties named \"password\" that are attempting to be stored with a Parse.User type object.\n\nConfiguration:\nParse SDK: 2.9.1\nParse Server: 3.9.0", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2020/08/GHSA-3fw8-66wf-pr7m/GHSA-3fw8-66wf-pr7m.json b/advisories/github-reviewed/2020/08/GHSA-3fw8-66wf-pr7m/GHSA-3fw8-66wf-pr7m.json index 3a1c5cd8d7e..ae7b1b42d41 100644 --- a/advisories/github-reviewed/2020/08/GHSA-3fw8-66wf-pr7m/GHSA-3fw8-66wf-pr7m.json +++ b/advisories/github-reviewed/2020/08/GHSA-3fw8-66wf-pr7m/GHSA-3fw8-66wf-pr7m.json @@ -8,9 +8,7 @@ ], "summary": "methodOverride Middleware Reflected Cross-Site Scripting in connect", "details": "Connect is a stack of middleware that is executed in order in each request.\n\nThe \"methodOverride\" middleware allows the http post to override the method of the request with the value of the \"_method\" post key or with the header \"x-http-method-override\".\n\nBecause the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the \"Cannot `[method]` `[url]`\" content. The method was not properly encoded for output in the browser.\n\n\n###Example:\n```\n~ curl \"localhost:3000\" -d \"_method=\"\nCannot /\n```\n\n## Recommendation\n\nUpdate to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2020/08/GHSA-5cp4-xmrw-59wf/GHSA-5cp4-xmrw-59wf.json b/advisories/github-reviewed/2020/08/GHSA-5cp4-xmrw-59wf/GHSA-5cp4-xmrw-59wf.json index efe92a9681b..3d68a973b41 100644 --- a/advisories/github-reviewed/2020/08/GHSA-5cp4-xmrw-59wf/GHSA-5cp4-xmrw-59wf.json +++ b/advisories/github-reviewed/2020/08/GHSA-5cp4-xmrw-59wf/GHSA-5cp4-xmrw-59wf.json @@ -3,9 +3,7 @@ "id": "GHSA-5cp4-xmrw-59wf", "modified": "2021-10-08T21:25:58Z", "published": "2020-08-05T21:47:02Z", - "aliases": [ - - ], + "aliases": [], "summary": "XSS via JQLite DOM manipulation functions in AngularJS", "details": "### Summary\nXSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.\n\n### Description\n\nJQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.\n\nOne of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).\n\nIf `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.\n\nThis is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).\n\n### Proof of concept\n\n```javascript\nconst inertPayload = `
` before adding it to the DOM, closing the style element early and reactivating `img`.\n\n### Patches\nThe issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery <3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).\n\n### Workarounds\nChanging sanitizer configuration not to allow certain tag grouping (e.g. `