diff --git a/advisories/unreviewed/2022/05/GHSA-8vpw-mgpf-mpvv/GHSA-8vpw-mgpf-mpvv.json b/advisories/github-reviewed/2022/05/GHSA-8vpw-mgpf-mpvv/GHSA-8vpw-mgpf-mpvv.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-8vpw-mgpf-mpvv/GHSA-8vpw-mgpf-mpvv.json rename to advisories/github-reviewed/2022/05/GHSA-8vpw-mgpf-mpvv/GHSA-8vpw-mgpf-mpvv.json index 435b39f7408..0d7d3180f1b 100644 --- a/advisories/unreviewed/2022/05/GHSA-8vpw-mgpf-mpvv/GHSA-8vpw-mgpf-mpvv.json +++ b/advisories/github-reviewed/2022/05/GHSA-8vpw-mgpf-mpvv/GHSA-8vpw-mgpf-mpvv.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-8vpw-mgpf-mpvv", - "modified": "2022-05-17T19:57:19Z", + "modified": "2024-02-01T20:53:42Z", "published": "2022-05-17T19:57:19Z", "aliases": [ "CVE-2014-9720" ], + "summary": "Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)", "details": "Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "tornado" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.2" + } + ] + } + ] + } ], "references": [ { @@ -30,6 +52,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1222816" }, + { + "type": "PACKAGE", + "url": "https://github.com/tornadoweb/tornado" + }, { "type": "WEB", "url": "http://openwall.com/lists/oss-security/2015/05/19/4" @@ -41,11 +67,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-203" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-01T20:53:42Z", "nvd_published_at": "2020-01-24T18:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-99f9-gv72-fw9r/GHSA-99f9-gv72-fw9r.json b/advisories/github-reviewed/2024/02/GHSA-99f9-gv72-fw9r/GHSA-99f9-gv72-fw9r.json new file mode 100644 index 00000000000..5e687a753d8 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-99f9-gv72-fw9r/GHSA-99f9-gv72-fw9r.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-99f9-gv72-fw9r", + "modified": "2024-02-01T20:53:08Z", + "published": "2024-02-01T20:53:08Z", + "aliases": [ + "CVE-2024-24753" + ], + "summary": "Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2", + "details": "## Impacted Resources\n\nbref/src/Event/Http/HttpResponse.php:61-90\n\n## Description\n\nWhen Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers.\n\nPrecisely, if PHP generates a response with two headers having the same key but different values only the latest one is kept.\n\n## Impact\n\nIf an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security.\n\nFor example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one.\n\n## PoC\n\n1. Create a new Bref project.\n2. Create an `index.php` file with the following content:\n```php\n\n\n\n```\n3. Use the following `serverless.yml` to deploy the Lambda:\n```yaml\nservice: app\n\nprovider:\n name: aws\n region: eu-central-1\n\nplugins:\n - ./vendor/bref/bref\n\nfunctions:\n api:\n handler: index.php\n description: ''\n runtime: php-81-fpm\n timeout: 28 # in seconds (API Gateway has a timeout of 29 seconds)\n events:\n - httpApi: '*'\n\n# Exclude files from deployment\npackage:\n patterns:\n - '!node_modules/**'\n - '!tests/**'\n```\n4. Browse the Lambda URL.\n5. Notice that the JavaScript code is executed as the `Content-Security-Policy: script-src 'none'` header has been removed.\n6. Notice that the external image has not been loaded as the `Content-Security-Policy: img-src 'self'` header has been kept.\n7. Start a PHP server inside the project directory (e.g. `php -S 127.0.0.1:8090`).\n8. Browse the `index.php` script through the PHP server (e.g. http://127.0.0.1:8090/index.php).\n9. Notice that the JavaScript code is not executed as the `Content-Security-Policy: script-src 'none'` header has been kept.\n10. Notice that the external image has not been loaded as the `Content-Security-Policy: img-src 'self'` header has been kept.\n\n## Suggested Remediation\n\nConcatenate all the multiple value headers' values with a comma (`,`) as separator and return a single header with all the values to the API Gateway.\n\n## References\n\n- https://www.rfc-editor.org/rfc/rfc9110.html#section-5.2", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "bref/bref" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.13" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/brefphp/bref/security/advisories/GHSA-99f9-gv72-fw9r" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24753" + }, + { + "type": "WEB", + "url": "https://github.com/brefphp/bref/commit/f834027aaf88b3885f4aa8edf6944ae920daf2dc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/brefphp/bref" + }, + { + "type": "WEB", + "url": "https://github.com/brefphp/bref/blob/2.1.12/src/Event/Http/HttpResponse.php#L61-L90" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-436" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-01T20:53:08Z", + "nvd_published_at": "2024-02-01T16:17:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-vgh3-mwxq-rcp8/GHSA-vgh3-mwxq-rcp8.json b/advisories/github-reviewed/2024/02/GHSA-vgh3-mwxq-rcp8/GHSA-vgh3-mwxq-rcp8.json similarity index 53% rename from advisories/unreviewed/2024/02/GHSA-vgh3-mwxq-rcp8/GHSA-vgh3-mwxq-rcp8.json rename to advisories/github-reviewed/2024/02/GHSA-vgh3-mwxq-rcp8/GHSA-vgh3-mwxq-rcp8.json index fc2d2f6e768..bc95b80ac4c 100644 --- a/advisories/unreviewed/2024/02/GHSA-vgh3-mwxq-rcp8/GHSA-vgh3-mwxq-rcp8.json +++ b/advisories/github-reviewed/2024/02/GHSA-vgh3-mwxq-rcp8/GHSA-vgh3-mwxq-rcp8.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vgh3-mwxq-rcp8", - "modified": "2024-02-01T03:30:22Z", + "modified": "2024-02-01T20:52:34Z", "published": "2024-02-01T03:30:22Z", "aliases": [ "CVE-2024-0831" ], + "summary": "Hashicorp Vault may expose sensitive log information", "details": "Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.", "severity": [ { @@ -14,20 +15,46 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/vault" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.15.0" + }, + { + "fixed": "1.15.5" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0831" }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/vault/commit/2a72f2a8a5b57de88c22a2a94c4a5f08c6f3770b" + }, { "type": "WEB", "url": "https://developer.hashicorp.com/vault/docs/upgrading/upgrade-to-1.15.x#audit-devices-could-log-raw-data-despite-configuration" }, { "type": "WEB", - "url": "https://link-to-discuss" + "url": "https://discuss.hashicorp.com/t/hcsec-2024-01-vault-may-expose-sensitive-information-when-configuring-an-audit-log-device/62311" + }, + { + "type": "PACKAGE", + "url": "https://github.com/hashicorp/vault" } ], "database_specific": { @@ -35,8 +62,8 @@ "CWE-532" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-01T20:52:34Z", "nvd_published_at": "2024-02-01T02:15:46Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-x4hh-frx8-98r5/GHSA-x4hh-frx8-98r5.json b/advisories/github-reviewed/2024/02/GHSA-x4hh-frx8-98r5/GHSA-x4hh-frx8-98r5.json new file mode 100644 index 00000000000..1abffc11a61 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-x4hh-frx8-98r5/GHSA-x4hh-frx8-98r5.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x4hh-frx8-98r5", + "modified": "2024-02-01T20:53:03Z", + "published": "2024-02-01T20:53:03Z", + "aliases": [ + "CVE-2024-24752" + ], + "summary": "Bref's Uploaded Files Not Deleted in Event-Driven Functions", + "details": "## Impacted Resources\n\nbref/src/Event/Http/Psr7Bridge.php:94-125\n\n## Description\n\nWhen Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object.\nDuring the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`.\n\nThe function implementing the logic follows:\n\n```php\nprivate static function parseBodyAndUploadedFiles(HttpRequestEvent $event): array\n{\n $bodyString = $event->getBody();\n $files = [];\n $parsedBody = null;\n $contentType = $event->getContentType();\n if ($contentType !== null && $event->getMethod() === 'POST') {\n if (str_starts_with($contentType, 'application/x-www-form-urlencoded')) {\n parse_str($bodyString, $parsedBody);\n } else {\n $document = new Part(\"Content-type: $contentType\\r\\n\\r\\n\" . $bodyString);\n if ($document->isMultiPart()) {\n $parsedBody = [];\n foreach ($document->getParts() as $part) {\n if ($part->isFile()) {\n $tmpPath = tempnam(sys_get_temp_dir(), 'bref_upload_');\n if ($tmpPath === false) {\n throw new RuntimeException('Unable to create a temporary directory');\n }\n file_put_contents($tmpPath, $part->getBody());\n $file = new UploadedFile($tmpPath, filesize($tmpPath), UPLOAD_ERR_OK, $part->getFileName(), $part->getMimeType());\n\n self::parseKeyAndInsertValueInArray($files, $part->getName(), $file);\n } else {\n self::parseKeyAndInsertValueInArray($parsedBody, $part->getName(), $part->getBody());\n }\n }\n }\n }\n }\n return [$files, $parsedBody];\n}\n```\n\nThe flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed.\n\n## Impact\n\nAn attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files.\nThe attack has the following requirements and limitations:\n- The Lambda should use the Event-Driven Function runtime.\n- The Lambda should use the `RequestHandlerInterface` handler.\n- The Lambda should implement at least an endpoint accepting POST requests.\n- The attacker can send requests up to 6MB long, so multiple requests are required to fill the disk (the default Lambda disk size is 512MB, therefore with less than 100 requests the disk could be filled).\n\n## PoC\n\n1. Create a new Bref project.\n2. Create an `index.php` file with the following content:\n```php\n` placeholder with the deployed Lambda domain:\n```\nPOST /upload HTTP/2\nHost: \nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryQqDeSZSSvmn2rfjb\nContent-Length: 180\n\n------WebKitFormBoundaryQqDeSZSSvmn2rfjb\nContent-Disposition: form-data; name=\"a\"; filename=\"a.txt\"\nContent-Type: text/plain\n\ntest\n------WebKitFormBoundaryQqDeSZSSvmn2rfjb--\n```\n5. Notice that each time the request is sent the number of the uploaded temporary files on the disk increases.\n\n## Suggested Remediation\n\nDelete the temporary files after the request has been processed and the response have been generated.\n\n## References\n\n- https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "bref/bref" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.13" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/brefphp/bref/security/advisories/GHSA-x4hh-frx8-98r5" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24752" + }, + { + "type": "WEB", + "url": "https://github.com/brefphp/bref/commit/350788de12880b6fd64c4c318ba995388bec840e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/brefphp/bref" + }, + { + "type": "WEB", + "url": "https://github.com/brefphp/bref/blob/2.1.12/src/Event/Http/Psr7Bridge.php#L94-L125" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-01T20:53:03Z", + "nvd_published_at": "2024-02-01T16:17:14Z" + } +} \ No newline at end of file