diff --git a/advisories/github-reviewed/2024/11/GHSA-2586-f3p4-hq84/GHSA-2586-f3p4-hq84.json b/advisories/github-reviewed/2024/11/GHSA-2586-f3p4-hq84/GHSA-2586-f3p4-hq84.json new file mode 100644 index 00000000000..84d319de49e --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-2586-f3p4-hq84/GHSA-2586-f3p4-hq84.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2586-f3p4-hq84", + "modified": "2025-02-18T19:25:51Z", + "published": "2024-11-12T18:30:58Z", + "aliases": [ + "CVE-2024-43598" + ], + "summary": "LightGBM Remote Code Execution Vulnerability", + "details": "LightGBM Remote Code Execution Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "lightgbm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "4.6.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43598" + }, + { + "type": "PACKAGE", + "url": "https://github.com/microsoft/LightGBM" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/lightgbm/PYSEC-2024-231.yaml" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-18T19:25:51Z", + "nvd_published_at": "2024-11-12T18:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-36h8-r92j-w9vw/GHSA-36h8-r92j-w9vw.json b/advisories/github-reviewed/2025/02/GHSA-36h8-r92j-w9vw/GHSA-36h8-r92j-w9vw.json new file mode 100644 index 00000000000..e2310f62689 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-36h8-r92j-w9vw/GHSA-36h8-r92j-w9vw.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-36h8-r92j-w9vw", + "modified": "2025-02-18T19:25:13Z", + "published": "2025-02-18T19:25:13Z", + "aliases": [ + "CVE-2025-24894" + ], + "summary": "The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass", + "details": "### Description\n\nAuthentication using Spid and CIE is based on the SAML2 standard which provides for two entities:\n\nIdentity Provider (IdP): the system that authenticates users and provides identity information ( SAML assertions ) to the Service Provider, essentially, it is responsible for managing user credentials and identity;\nService Provider (SP): The system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources.\nThe library `spid-aspnetcorerefers` to the second entity, i.e. the SP, and implements the validation logic of the SAML assertions present within the SAML response . The following is a summary diagram of an authentication flow via SAML:\n\n![](https://github.com/user-attachments/assets/5b10c8f8-5121-446f-95f8-c0355daa5959)\n\nAs shown in the diagram, the IdP, after verifying the user's credentials, generates a signed SAML response, this is propagated to the SP by the user's browser and the SP, after verifying the signature, can extract the data needed to build the user's session.\n\nThe signature validation logic is central as it ensures that you cannot craft a SAML response with arbitrary assertions and thus impersonate other users.\n\nThe following is the validation code implemented in `spid-aspnetcore`.\n\n```csharp\ninternal static bool VerifySignature(XmlDocument signedDocument, IdentityProvider? identityProvider = null){\n //...SNIP...\n SignedXml signedXml = new SignedXml(signedDocument);\n if (identityProvider is not null)\n {\n bool validated = false;\n foreach (var certificate in identityProvider.X509SigningCertificates){\n var publicMetadataCert = new X509Certificate2(Convert.FromBase64String(certificate));\n XmlNodeList nodeList = (signedDocument.GetElementsByTagName(\"ds:Signature\")?.Count > 1) ?\n signedDocument.GetElementsByTagName(\"ds:Signature\") :\n (signedDocument.GetElementsByTagName(\"ns2:Signature\")?.Count > 1) ?\n signedDocument.GetElementsByTagName(\"ns2:Signature\") :\n signedDocument.GetElementsByTagName(\"Signature\");\n signedXml.LoadXml((XmlElement)nodeList[0]);\n validated |= signedXml.CheckSignature(publicMetadataCert, true);\n }\n return validated;\n }\n else{\n XmlNodeList nodeList = (signedDocument.GetElementsByTagName(\"ds:Signature\")?.Count > 0) ?\n signedDocument.GetElementsByTagName(\"ds:Signature\") :\n signedDocument.GetElementsByTagName(\"Signature\");\n signedXml.LoadXml((XmlElement)nodeList[0]);\n return signedXml.CheckSignature();\n }\n //...SNIP...\n}\n```\n\nThe parameter `signedDocument` contains the SAML response in XML format, while the parameter `identityProvider` can contain the IdP info. If the parameter `identityProvider` has been specified, the public certificates of that IdP are extracted, so as to force their use during the signature verification, otherwise the certificates configured within the application are used.\n\nNext, a response envelope is generated nodeList within which all XML elements containing an XML signature of part or all of the SAML response envelope are saved.\n\nFinally, the first element of this list, i.e. the first signature found, is extracted and verified.\n\nIn a normal authentication flow, the SAML response looks like this (note that some fields and attributes have been omitted for ease of reading):\n\n```xml\n\n \n https://demo.spid.gov.it/validator\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n https://demo.spid.gov.it/validator\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n AGID-001\n \n \n \n \n \n\n```\n\nThe SDK code would get as the first element of the `nodeList`, that is `nodeList[0]`, the signature referring to the entire SAML response, in fact the reference of the first signature `` points to the root object ``. Therefore, verifying this signature will ensure that the entire content of the SAML response is intact and authentic.\n\nHowever, there is no guarantee that the first signature refers to the root object, so if an attacker injects a signed element as the first element, all other signatures will not be verified. The only requirement is to have a legitimately signed XML element from the IdP, which is easily accomplished using the public metadata of the IdP.\n\nThe SAML response would be structured like this:\n\n![](https://github.com/user-attachments/assets/42b8c97a-96ae-45c9-afed-aab7066201a1)\n\n### Impact\nAn attacker could craft an arbitrary SAML response that would be accepted by SPs using the vulnerable SDKs, allowing him to impersonate any Spid and/or CIE user.\n\n### Complexity of the attack\nThe attacker needs an XML block containing a valid signature from one of the IdPs accepted by the SP. As described above, this requirement is satisfied by reading the public metadata of the IdP which is represented by a signed XML block of the IdP.\n\n### Related issues\nN/A\n\n### PoC\n\n1. Clone the repository https://github.com/italia/spid-aspnetcore.git\n2. From the root of the project, enter the folder relating to the example webapp: `samples/1_SimpleSPWebApp/SPID.AspNetCore.WebApp/`\n3. Change the value of the `AssertionConsumerServiceURL` key in the file `appsettings.json` to a custom domain: `https://$CUSTOM_DOMAIN:$CUSTOM_PORT/signin-spid`\n4. Compile and run the sample webapp using the following command, taking care to replace the placeholders with the same values ​​used in step 3: `dotnet build \"SPID.AspNetCore.WebApp.csproj\" -o ./app/build && dotnet publish \"SPID.AspNetCore.WebApp.csproj\" -o ./app/publish && dotnet ./app/publish/SPID.AspNetCore.WebApp.dll -urls=https://$CUSTOM_DOMAIN:$CUSTOM_PORT`\n5. Visit URL: `https://$CUSTOM_DOMAIN:$CUSTOM_PORT/`\n6. Click \"Enter with SPID\" > \"DemoSpid\" (second IdP in the list)\n7. Visit the \"Response\" > \"Check Response\" section\n8. Insert the following string into the \"Audience\" field (right column): `https://spid.aspnetcore.it/`\n9. Click \"Send response to Service Provider\", note the redirect to `/home/loggedin` and consequently the correct execution of the login on the example portal\n\n![](https://github.com/user-attachments/assets/af3775a1-5f01-4ffa-9b28-730fef487869)\n\n10. Repeat steps 5 to 8 inclusive\n11. Intercept the HTTP request generated in step 8 via an HTTP Proxy, such as PortSwigger's BurpSuite\n12. Perform URL-decoding and Base64-decoding of the POST `SAMLResponse` parameter\n13. Insert the content present at the following URL in the second line of the XML: https://demo.spid.gov.it/metadata.xml\n14. Change the contents of the tag ``, for example change the `email` attribute to an arbitrary value: `spid.tech@shielder.it`\n15. Run Base64-encoding and then URL-encoding the `SAMLResponse` parameter\n16. Send the request and note the redirect to `/home/loggedin` which demonstrates the correct identification and therefore also the verification of the arbitrary signature inserted in `SAMLResponse` despite the modification of the assertion\n\n![](https://github.com/user-attachments/assets/a725401f-7884-4910-b4e5-b6c55c1cde83)\n\n### Recommended Solution\n\nVerify all signatures within the SAML response and do not accept unsigned XML elements.\n\n### References\n\n- https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html\n\n### Credits\n- [Abdel Adim `smaury` Oisfi](https://x.com/smaury92) di [Shielder](https://www.shielder.com)\n- [Paolo`paupu` Cavaglià](https://x.com/paupu_95) di [Shielder](https://www.shielder.com)\n- [Nicola `fromveeko` Davico](https://x.com/fromveeko) di [Shielder](https://www.shielder.com)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "SPID.AspNetCore.Authentication" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.4.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.3.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/italia/spid-aspnetcore/security/advisories/GHSA-36h8-r92j-w9vw" + }, + { + "type": "WEB", + "url": "https://github.com/italia/spid-aspnetcore/commit/093efa2273f8a1e0481f678a0bfcd57fbdc7b029" + }, + { + "type": "PACKAGE", + "url": "https://github.com/italia/spid-aspnetcore" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-290" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-18T19:25:13Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json b/advisories/github-reviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json similarity index 60% rename from advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json rename to advisories/github-reviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json index 90b9346fc3a..78c0593423d 100644 --- a/advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json +++ b/advisories/github-reviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-hw8r-x6gr-5gjp", - "modified": "2025-02-15T06:30:51Z", + "modified": "2025-02-18T19:25:34Z", "published": "2025-02-15T06:30:51Z", "aliases": [ "CVE-2025-1302" ], - "details": "Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.\n\n**Note:**\n\nThis is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).", + "summary": "JSONPath Plus allows Remote Code Execution", + "details": "Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.\n\n**Note:**\n\nThis is caused by an incomplete fix for CVE-2024-21534.", "severity": [ { "type": "CVSS_V3", @@ -14,11 +15,35 @@ }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "jsonpath-plus" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "10.3.0" + } + ] + } + ] } ], - "affected": [], "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21534" + }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1302" @@ -31,9 +56,13 @@ "type": "WEB", "url": "https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456" }, + { + "type": "PACKAGE", + "url": "https://github.com/JSONPath-Plus/JSONPath" + }, { "type": "WEB", - "url": "https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127" + "url": "https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js#L127" }, { "type": "WEB", @@ -45,8 +74,8 @@ "CWE-94" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-18T19:25:34Z", "nvd_published_at": "2025-02-15T05:15:11Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-m3pm-rpgg-5wj6/GHSA-m3pm-rpgg-5wj6.json b/advisories/github-reviewed/2025/02/GHSA-m3pm-rpgg-5wj6/GHSA-m3pm-rpgg-5wj6.json new file mode 100644 index 00000000000..b3905174f3d --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-m3pm-rpgg-5wj6/GHSA-m3pm-rpgg-5wj6.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3pm-rpgg-5wj6", + "modified": "2025-02-18T19:25:24Z", + "published": "2025-02-18T19:25:24Z", + "aliases": [ + "CVE-2025-25305" + ], + "summary": "Home Assistant does not correctly validate SSL for outgoing requests in core and used libs", + "details": "## Summary\n\nProblem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries.\n\n## Details\n\nIn the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen.\n\nWhen migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector.\n\nExample:\nhttps://github.com/home-assistant/core/blob/c4411914c2e906105b765c00af5740bd0880e946/homeassistant/components/discord/notify.py#L84\n\nWhen you scan the libraries used by the integrations in Home Assistant, you will find more issues like this.\n\nThe general handling in Home Assistant looks good, as `homeassistant.helpers.aoihttp_client._async_get_connector` handles it correctly.\n\n## PoC\n\n1. Check that expired.badssl.com:443 gives an SSL error in when connecting with curl or browser.\n2. Add the integration adguard with the setting `host=expired.badssl.com`, `port=443`, `use-ssl=true`, `verify-ssl=true`.\n3. Check the logs - you get a HTTP 403 response.\n\nExpected behavior:\n1. The integration log shows an `ssl.SSLCertVerificationError`.\n\nThe following code shows the problem with `ssl=True`. No exception is raised when `ssl=True` (Python 3.11.6).\n\n```\nimport asyncio\nfrom ssl import SSLCertVerificationError\n\nimport aiohttp\n\nBAD_URL = \"https://expired.badssl.com/\"\n\n\nasync def run_request(verify_ssl, result_placeholder: str):\n async with aiohttp.ClientSession() as session:\n exception_fired: bool = False\n try:\n await session.request(\"OPTIONS\", BAD_URL, ssl=verify_ssl)\n except SSLCertVerificationError:\n exception_fired = True\n except Exception as error:\n print(error)\n else:\n exception_fired = False\n print(result_placeholder.format(exception_result=exception_fired))\n\n\n# Case 1: ssl=False --> expected result: No exception\nasyncio.run(run_request(False, \"Test case 1: expected result: False - result: {exception_result}\"))\n\n# Case 2: ssl=None --> expected result: Exception\nasyncio.run(run_request(None, \"Test case 2: expected result: True - result: {exception_result}\"))\n\n# Case 3: ssl=True --> expected result: No Exception\nasyncio.run(run_request(True, \"Test case 3: expected result: False - result: {exception_result}\"))\n\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "homeassistant" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2024.1.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6" + }, + { + "type": "WEB", + "url": "https://github.com/home-assistant/core/commit/8c6547f1b64f4a3d9f10090b97383353c9367892" + }, + { + "type": "PACKAGE", + "url": "https://github.com/home-assistant/core" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-18T19:25:24Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-vq63-8f72-f486/GHSA-vq63-8f72-f486.json b/advisories/github-reviewed/2025/02/GHSA-vq63-8f72-f486/GHSA-vq63-8f72-f486.json new file mode 100644 index 00000000000..b26600bb8f7 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-vq63-8f72-f486/GHSA-vq63-8f72-f486.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vq63-8f72-f486", + "modified": "2025-02-18T19:25:19Z", + "published": "2025-02-18T19:25:19Z", + "aliases": [ + "CVE-2025-24895" + ], + "summary": "AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass", + "details": "### Description\n\nAuthentication using Spid and CIE is based on the SAML2 standard which provides for two entities:\n\nIdentity Provider (IdP): the system that authenticates users and provides identity information ( SAML assertions ) to the Service Provider, essentially, it is responsible for managing user credentials and identity;\nService Provider (SP): The system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources.\nThe library `cie-aspnetcorerefers` to the second entity, i.e. the SP, and implements the validation logic of the SAML assertions present within the SAML response . The following is a summary diagram of an authentication flow via SAML:\n\n![](https://github.com/user-attachments/assets/5b10c8f8-5121-446f-95f8-c0355daa5959)\n\nAs shown in the diagram, the IdP, after verifying the user's credentials, generates a signed SAML response, this is propagated to the SP by the user's browser and the SP, after verifying the signature, can extract the data needed to build the user's session.\n\nThe signature validation logic is central as it ensures that you cannot craft a SAML response with arbitrary assertions and thus impersonate other users.\n\nThe following is the validation code implemented in `cie-aspnetcore`.\n\n```csharp\ninternal static bool VerifySignature(XmlDocument signedDocument, IdentityProvider? identityProvider = null){\n //...SNIP...\n SignedXml signedXml = new SignedXml(signedDocument);\n if (identityProvider is not null)\n {\n bool validated = false;\n foreach (var certificate in identityProvider.X509SigningCertificates){\n var publicMetadataCert = new X509Certificate2(Convert.FromBase64String(certificate));\n XmlNodeList nodeList = (signedDocument.GetElementsByTagName(\"ds:Signature\")?.Count > 1) ?\n signedDocument.GetElementsByTagName(\"ds:Signature\") :\n (signedDocument.GetElementsByTagName(\"ns2:Signature\")?.Count > 1) ?\n signedDocument.GetElementsByTagName(\"ns2:Signature\") :\n signedDocument.GetElementsByTagName(\"Signature\");\n signedXml.LoadXml((XmlElement)nodeList[0]);\n validated |= signedXml.CheckSignature(publicMetadataCert, true);\n }\n return validated;\n }\n else{\n XmlNodeList nodeList = (signedDocument.GetElementsByTagName(\"ds:Signature\")?.Count > 0) ?\n signedDocument.GetElementsByTagName(\"ds:Signature\") :\n signedDocument.GetElementsByTagName(\"Signature\");\n signedXml.LoadXml((XmlElement)nodeList[0]);\n return signedXml.CheckSignature();\n }\n //...SNIP...\n}\n```\n\nThe parameter `signedDocument` contains the SAML response in XML format, while the parameter `identityProvider` can contain the IdP info. If the parameter `identityProvider` has been specified, the public certificates of that IdP are extracted, so as to force their use during the signature verification, otherwise the certificates configured within the application are used.\n\nNext, a response envelope is generated nodeList within which all XML elements containing an XML signature of part or all of the SAML response envelope are saved.\n\nFinally, the first element of this list, i.e. the first signature found, is extracted and verified.\n\nIn a normal authentication flow, the SAML response looks like this (note that some fields and attributes have been omitted for ease of reading):\n\n```xml\n\n \n https://demo.spid.gov.it/validator\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n https://demo.spid.gov.it/validator\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n AGID-001\n \n \n \n \n \n\n```\n\nThe SDK code would get as the first element of the `nodeList`, that is `nodeList[0]`, the signature referring to the entire SAML response, in fact the reference of the first signature `` points to the root object ``. Therefore, verifying this signature will ensure that the entire content of the SAML response is intact and authentic.\n\nHowever, there is no guarantee that the first signature refers to the root object, so if an attacker injects a signed element as the first element, all other signatures will not be verified. The only requirement is to have a legitimately signed XML element from the IdP, which is easily accomplished using the public metadata of the IdP.\n\nThe SAML response would be structured like this:\n\n![](https://github.com/user-attachments/assets/42b8c97a-96ae-45c9-afed-aab7066201a1)\n\n### Impact\nAn attacker could craft an arbitrary SAML response that would be accepted by SPs using the vulnerable SDKs, allowing him to impersonate any Spid and/or CIE user.\n\n### Complexity of the attack\nThe attacker needs an XML block containing a valid signature from one of the IdPs accepted by the SP. As described above, this requirement is satisfied by reading the public metadata of the IdP which is represented by a signed XML block of the IdP.\n\n### Related issues\nN/A\n\n### PoC\n\n1. Clone the repository https://github.com/italia/spid-aspnetcore.git\n2. From the root of the project, enter the folder relating to the example webapp: `samples/1_SimpleSPWebApp/SPID.AspNetCore.WebApp/`\n3. Change the value of the `AssertionConsumerServiceURL` key in the file `appsettings.json` to a custom domain: `https://$CUSTOM_DOMAIN:$CUSTOM_PORT/signin-spid`\n4. Compile and run the sample webapp using the following command, taking care to replace the placeholders with the same values ​​used in step 3: `dotnet build \"SPID.AspNetCore.WebApp.csproj\" -o ./app/build && dotnet publish \"SPID.AspNetCore.WebApp.csproj\" -o ./app/publish && dotnet ./app/publish/SPID.AspNetCore.WebApp.dll -urls=https://$CUSTOM_DOMAIN:$CUSTOM_PORT`\n5. Visit URL: `https://$CUSTOM_DOMAIN:$CUSTOM_PORT/`\n6. Click \"Enter with SPID\" > \"DemoSpid\" (second IdP in the list)\n7. Visit the \"Response\" > \"Check Response\" section\n8. Insert the following string into the \"Audience\" field (right column): `https://spid.aspnetcore.it/`\n9. Click \"Send response to Service Provider\", note the redirect to `/home/loggedin` and consequently the correct execution of the login on the example portal\n\n![](https://github.com/user-attachments/assets/af3775a1-5f01-4ffa-9b28-730fef487869)\n\n10. Repeat steps 5 to 8 inclusive\n11. Intercept the HTTP request generated in step 8 via an HTTP Proxy, such as PortSwigger's BurpSuite\n12. Perform URL-decoding and Base64-decoding of the POST `SAMLResponse` parameter\n13. Insert the content present at the following URL in the second line of the XML: https://demo.spid.gov.it/metadata.xml\n14. Change the contents of the tag ``, for example change the `email` attribute to an arbitrary value: `spid.tech@shielder.it`\n15. Run Base64-encoding and then URL-encoding the `SAMLResponse` parameter\n16. Send the request and note the redirect to `/home/loggedin` which demonstrates the correct identification and therefore also the verification of the arbitrary signature inserted in `SAMLResponse` despite the modification of the assertion\n\n![](https://github.com/user-attachments/assets/a725401f-7884-4910-b4e5-b6c55c1cde83)\n\n### Recommended Solution\n\nVerify all signatures within the SAML response and do not accept unsigned XML elements.\n\n### References\n\n- https://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html\n\n### Credits\n- [Abdel Adim `smaury` Oisfi](https://x.com/smaury92) di [Shielder](https://www.shielder.com)\n- [Paolo`paupu` Cavaglià](https://x.com/paupu_95) di [Shielder](https://www.shielder.com)\n- [Nicola `fromveeko` Davico](https://x.com/fromveeko) di [Shielder](https://www.shielder.com)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "CIE.AspNetCore.Authentication" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.0.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/italia/cie-aspnetcore/security/advisories/GHSA-vq63-8f72-f486" + }, + { + "type": "WEB", + "url": "https://github.com/italia/cie-aspnetcore/commit/e66b7f336ff5d4c69f95f197f27f3145f2484994" + }, + { + "type": "PACKAGE", + "url": "https://github.com/italia/cie-aspnetcore" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-290" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-18T19:25:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-2586-f3p4-hq84/GHSA-2586-f3p4-hq84.json b/advisories/unreviewed/2024/11/GHSA-2586-f3p4-hq84/GHSA-2586-f3p4-hq84.json deleted file mode 100644 index 40a9781462d..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-2586-f3p4-hq84/GHSA-2586-f3p4-hq84.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2586-f3p4-hq84", - "modified": "2024-11-12T18:30:58Z", - "published": "2024-11-12T18:30:58Z", - "aliases": [ - "CVE-2024-43598" - ], - "details": "LightGBM Remote Code Execution Vulnerability", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43598" - }, - { - "type": "WEB", - "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-122" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-12T18:15:28Z" - } -} \ No newline at end of file