From c560639773fc9b2680d3912eab3a33911a6d6f3e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 18 Nov 2024 20:03:50 +0000 Subject: [PATCH] Publish Advisories GHSA-qc99-r4wh-c8h6 GHSA-7cc9-j4mv-vcjp GHSA-jp37-5qhw-mffw GHSA-vggm-3478-vm5m --- .../GHSA-qc99-r4wh-c8h6.json | 33 ++++- .../GHSA-7cc9-j4mv-vcjp.json | 118 ++++++++++++++++++ .../GHSA-jp37-5qhw-mffw.json | 61 +++++++++ .../GHSA-vggm-3478-vm5m.json | 54 ++++++++ 4 files changed, 261 insertions(+), 5 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json (50%) create mode 100644 advisories/github-reviewed/2024/11/GHSA-7cc9-j4mv-vcjp/GHSA-7cc9-j4mv-vcjp.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-jp37-5qhw-mffw/GHSA-jp37-5qhw-mffw.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json diff --git a/advisories/unreviewed/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json b/advisories/github-reviewed/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json similarity index 50% rename from advisories/unreviewed/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json rename to advisories/github-reviewed/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json index 5ed320b24aa..f1f845d8b68 100644 --- a/advisories/unreviewed/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json +++ b/advisories/github-reviewed/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-qc99-r4wh-c8h6", - "modified": "2024-11-16T00:31:48Z", + "modified": "2024-11-18T20:02:52Z", "published": "2024-03-29T00:30:34Z", "aliases": [ "CVE-2024-29316" ], - "details": "NodeBB 3.6.7 is vulnerable to Incorrect Access Control.", + "summary": "Incorrect Access Control in NodeBB", + "details": "In NodeBB prior to 3.6.7 an attacker was able to access the restricted tabs for the Admin group which are only allowed the the administrators.", "severity": [ { "type": "CVSS_V3", @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "nodebb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.7" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29316" }, + { + "type": "PACKAGE", + "url": "https://github.com/NodeBB/NodeBB" + }, { "type": "WEB", "url": "https://medium.com/%40krityamkarma858041/broken-access-control-nodebb-v3-6-7-eebc59c24deb" @@ -35,8 +58,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:02:52Z", "nvd_published_at": "2024-03-28T23:15:46Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-7cc9-j4mv-vcjp/GHSA-7cc9-j4mv-vcjp.json b/advisories/github-reviewed/2024/11/GHSA-7cc9-j4mv-vcjp/GHSA-7cc9-j4mv-vcjp.json new file mode 100644 index 00000000000..782b2541ea5 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-7cc9-j4mv-vcjp/GHSA-7cc9-j4mv-vcjp.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7cc9-j4mv-vcjp", + "modified": "2024-11-18T20:01:46Z", + "published": "2024-11-18T20:01:46Z", + "aliases": [ + "CVE-2024-48917" + ], + "summary": "XXE in PHPSpreadsheet's XLSX reader", + "details": "### Summary\n\nThe [XmlScanner class](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php) has a [scan](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L72) method which should prevent XXE attacks.\n\nHowever, we found another bypass than the previously reported `CVE-2024-47873`, the regexes from the [findCharSet](https://github.com/PHPOffice/PhpSpreadsheet/blob/39fc51309181e82593b06e2fa8e45ef8333a0335/src/PhpSpreadsheet/Reader/Security/XmlScanner.php#L51) method, which is used for determining the current encoding can be bypassed by using a payload in the encoding UTF-7, and adding at end of the file a comment with the value `encoding=\"UTF-8\"` with `\"`, which is matched by the first regex, so that `encoding='UTF-7'` with single quotes `'` in the XML header is not matched by the second regex: \n\n```\n $patterns = [\n '/encoding\\\\s*=\\\\s*\"([^\"]*]?)\"/',\n \"/encoding\\\\s*=\\\\s*'([^']*?)'/\",\n ];\n``` \n\nA payload for the `workbook.xml` file can for example be created with [CyberChef](https://gchq.github.io/CyberChef/#recipe=Encode_text('UTF-7%20(65000)')&input=Pz4KPCFET0NUWVBFIGZvbyBbCiAgPCFFTEVNRU5UIGZvbyBBTlkgPgogIDwhRU5USVRZIHh4ZSBTWVNURU0gImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgPl0%2BCjxmb28%2BJnh4ZTs8L2Zvbz4K).\nIf you open an Excel file containing the payload from the link above stored in the `workbook.xml` file with PhpSpreadsheet, you will receive an HTTP request on `127.0.0.1:12345`. You can test that an HTTP request is created by running the `nc -nlvp 12345` command before opening the file containing the payload with PhpSpreadsheet.\n\nTo create the payload you need:\n1. Create a file containing `setReadDataOnly(true);\n\n$worksheetData = $reader->listWorksheetInfo($inputFileName);\n\nforeach ($worksheetData as $worksheet) {\n\n$sheetName = $worksheet['worksheetName'];\n\necho \"

$sheetName

\";\n/** Load $inputFileName to a Spreadsheet Object **/\n$reader->setLoadSheetsOnly($sheetName);\n$spreadsheet = $reader->load($inputFileName);\n\n$worksheet = $spreadsheet->getActiveSheet();\nprint_r($worksheet->toArray());\n\n}\n```\n- Run the following command: `php -S 127.0.0.1:8080`\n- Add the [payload.xlsx](https://github.com/user-attachments/files/17375792/payload.xlsx) file in the folder and open in a browser. You will see an HTTP request on netcat .\n\n### Impact\n\nAn attacker can bypass the sanitizer and achieve an [XXE attack](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing).\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.29.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.1.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.0" + }, + { + "fixed": "2.3.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpoffice/phpspreadsheet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.3.0" + }, + { + "fixed": "3.4.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-7cc9-j4mv-vcjp" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PHPOffice/PhpSpreadsheet" + }, + { + "type": "WEB", + "url": "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:01:46Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-jp37-5qhw-mffw/GHSA-jp37-5qhw-mffw.json b/advisories/github-reviewed/2024/11/GHSA-jp37-5qhw-mffw/GHSA-jp37-5qhw-mffw.json new file mode 100644 index 00000000000..261467a85ca --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-jp37-5qhw-mffw/GHSA-jp37-5qhw-mffw.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jp37-5qhw-mffw", + "modified": "2024-11-18T20:03:25Z", + "published": "2024-11-18T20:03:25Z", + "aliases": [ + + ], + "summary": "Sharks has a Bias of Polynomial Coefficients in Secret Sharing", + "details": "Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range `[0, 255]` they were instead in the range `[1, 255]`. A description from Cure53, who originally found the issue, is available:\n\n> The correct method to select a random polynomial would be to select all coefficients (including the most significant coefficient) uniformly in the range 0..255 (inclusive). Otherwise, knowledge that a coefficient in a polynomial cannot be 0 permits the exclusion of single byte values for the shared secret given one share less than required. [...] Exploiting this weakness necessitates sharing the same secret multiple times. In this scenario, an attacker could exclude an exponential number of values for each of the shared bytes until sufficiently few values remain for brute forcing. Cure53 estimates that under ideal circumstances (e.g., a 2-out-of-N scheme) a shared secret can be reconstructed if the same secret has been distributed 500-1500 times.\n\nSecrets that have been shared a low amount of times (ideally, once) would not be impacted. However, secrets that are repeatedly shared may be vulnerable, especially if the shares are still available, and should be rotated.\n\nThe vulnerability does not impact reconstitution of secrets: secrets that have already been split can be recombined without issue.\n\nThe flaw can be corrected by changing the lower bound of the polynomial coefficient range in the `sharks::math::random_polynomial` function to `0`. The `blahaj` crate has been made available with a fixed version of the code, after attempts to reach the maintainer of the `sharks` crate were unsuccessful.\n", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "sharks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.5.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://git.distrust.co/public/blahaj/commit/4faab1cd33d455f0ca2ccc7208093fd6c18e0767" + }, + { + "type": "PACKAGE", + "url": "https://github.com/c0dearm/sharks" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2024-0398.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-334" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:03:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json b/advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json new file mode 100644 index 00000000000..d26b758cc3b --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vggm-3478-vm5m", + "modified": "2024-11-18T20:02:26Z", + "published": "2024-11-18T20:02:26Z", + "aliases": [ + "CVE-2024-52506" + ], + "summary": "Graylog concurrent PDF report rendering can leak other users' reports", + "details": "### Impact\n\nThe reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users.\n\nWhen multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance \"freshness\" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests \"wins\" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to.\n\n### Patches\nThis problem is fixed in Graylog 6.1.2.\n\n### Workarounds\nThere is no known workaround besides disabling the reporting functionality.\n\n### References\n\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.graylog:graylog-parent" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-vggm-3478-vm5m" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Graylog2/graylog2-server" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:02:26Z", + "nvd_published_at": null + } +} \ No newline at end of file