From bd3fd10745b33ccfae127a904150331931582463 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 10 Apr 2025 23:07:53 +0000 Subject: [PATCH] Publish Advisories GHSA-c69x-5xmw-v44x GHSA-rhx4-hvx9-j387 --- .../2024/03/GHSA-c69x-5xmw-v44x/GHSA-c69x-5xmw-v44x.json | 4 ++-- .../2025/04/GHSA-rhx4-hvx9-j387/GHSA-rhx4-hvx9-j387.json | 8 ++++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/advisories/github-reviewed/2024/03/GHSA-c69x-5xmw-v44x/GHSA-c69x-5xmw-v44x.json b/advisories/github-reviewed/2024/03/GHSA-c69x-5xmw-v44x/GHSA-c69x-5xmw-v44x.json index 43a524ed7d8..4662e0d3cc6 100644 --- a/advisories/github-reviewed/2024/03/GHSA-c69x-5xmw-v44x/GHSA-c69x-5xmw-v44x.json +++ b/advisories/github-reviewed/2024/03/GHSA-c69x-5xmw-v44x/GHSA-c69x-5xmw-v44x.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-c69x-5xmw-v44x", - "modified": "2024-04-10T16:42:59Z", + "modified": "2025-04-10T23:07:21Z", "published": "2024-03-06T15:25:08Z", "aliases": [ "CVE-2024-24767" ], "summary": "CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability", - "details": "### Summary\nHere it is observed that the CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server.\n\n### Details\nThe web application lacks control over the login attempts i.e. why attacker can use a password brute force attack to find and get full access over the.\n\n### PoC\n1. Capture login request in proxy tool like Burp Suite and select password field.\n\n![1](https://user-images.githubusercontent.com/63414468/297156515-0272bfd7-f386-4c22-b3bd-c4dbdc1298bf.PNG)\n\n2. Here I have started attack with total number of 271 password tries where the last one is the correct password and as we can see in the following image we get a **400 Bad Request** status code with the message \"**Invalid Password**\" and response length **769** on 1st request which was sent at **_Tue, 16 Jan 2024 18:31:32 GMT_**\n\n![2](https://user-images.githubusercontent.com/63414468/297157815-c158995b-7d46-4a5a-aef9-bcbbcf596b15.png)\n\n**Note**: _We have tested this vulnerability with more than 3400 tries. We have used 271 request counts just for demo purposes._\n\n\n3. Here the attack is completed and we can see in the following image we get **200 OK** status code with the message \"**Ok**\" and response length **1509** on 271st request which was sent at **_Tue, 16 Jan 2024 18:32:01 GMT_**.\n\n![3](https://user-images.githubusercontent.com/63414468/297159282-3f4788b5-6217-4f32-8be6-40ac117710e3.png)\n\nThis means attacker can try 271 requests in 56 seconds.\n\n### Impact\nThis vulnerability allows attackers to get super user-level access over the server.\n\n\n### Mitigation\nIt is recommended to implement a proper rate-limiting mechanism on the server side where the configuration might be like:\nIf a specific IP address fails to login more than 5 times concurrently then that IP address must be blocked for at least 30 seconds. This will reduce the possibility of password brute-forcing attacks.\n", + "details": "### Summary\nHere it is observed that the CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server.\n\n### Details\nThe web application lacks control over the login attempts i.e. why attacker can use a password brute force attack to find and get full access over the.\n\n### PoC\n1. Capture login request in proxy tool like Burp Suite and select password field.\n\n![1](https://user-images.githubusercontent.com/63414468/297156515-0272bfd7-f386-4c22-b3bd-c4dbdc1298bf.PNG)\n\n2. Here I have started attack with total number of 271 password tries where the last one is the correct password and as we can see in the following image we get a **400 Bad Request** status code with the message \"**Invalid Password**\" and response length **769** on 1st request which was sent at **_Tue, 16 Jan 2024 18:31:32 GMT_**\n\n![2](https://user-images.githubusercontent.com/63414468/297157815-c158995b-7d46-4a5a-aef9-bcbbcf596b15.png)\n\n**Note**: _We have tested this vulnerability with more than 3400 tries. We have used 271 request counts just for demo purposes._\n\n\n3. Here the attack is completed and we can see in the following image we get **200 OK** status code with the message \"**Ok**\" and response length **1509** on 271st request which was sent at **_Tue, 16 Jan 2024 18:32:01 GMT_**.\n\n![3](https://user-images.githubusercontent.com/63414468/297159282-3f4788b5-6217-4f32-8be6-40ac117710e3.png)\n\nThis means attacker can try 271 requests in 56 seconds.\n\n### Impact\nThis vulnerability allows attackers to get super user-level access over the server.\n\n\n### Mitigation\nIt is recommended to implement a proper rate-limiting mechanism on the server side where the configuration might be like:\nIf a specific IP address fails to login more than 5 times concurrently then that IP address must be blocked for at least 30 seconds. This will reduce the possibility of password brute-forcing attacks.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/04/GHSA-rhx4-hvx9-j387/GHSA-rhx4-hvx9-j387.json b/advisories/github-reviewed/2025/04/GHSA-rhx4-hvx9-j387/GHSA-rhx4-hvx9-j387.json index 9a59ce960db..e14a6a20308 100644 --- a/advisories/github-reviewed/2025/04/GHSA-rhx4-hvx9-j387/GHSA-rhx4-hvx9-j387.json +++ b/advisories/github-reviewed/2025/04/GHSA-rhx4-hvx9-j387/GHSA-rhx4-hvx9-j387.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rhx4-hvx9-j387", - "modified": "2025-04-10T13:39:11Z", + "modified": "2025-04-10T23:06:04Z", "published": "2025-04-10T13:39:11Z", "aliases": [ "CVE-2025-30148" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j387" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30148" + }, { "type": "WEB", "url": "https://github.com/silverstripe/silverstripe-framework/pull/11682" @@ -68,6 +72,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-04-10T13:39:11Z", - "nvd_published_at": null + "nvd_published_at": "2025-04-10T13:15:51Z" } } \ No newline at end of file