diff --git a/advisories/github-reviewed/2025/04/GHSA-356w-63v5-8wf4/GHSA-356w-63v5-8wf4.json b/advisories/github-reviewed/2025/04/GHSA-356w-63v5-8wf4/GHSA-356w-63v5-8wf4.json new file mode 100644 index 00000000000..0db00679693 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-356w-63v5-8wf4/GHSA-356w-63v5-8wf4.json @@ -0,0 +1,141 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-356w-63v5-8wf4", + "modified": "2025-04-11T14:06:03Z", + "published": "2025-04-11T14:06:03Z", + "aliases": [ + "CVE-2025-32395" + ], + "summary": "Vite has an `server.fs.deny` bypass with an invalid `request-target`", + "details": "### Summary\nThe contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.\n\n### Impact\nOnly apps with the following conditions are affected.\n\n- explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host))\n- running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun)\n\n### Details\n\n[HTTP 1.1 spec (RFC 9112) does not allow `#` in `request-target`](https://datatracker.ietf.org/doc/html/rfc9112#section-3.2). Although an attacker can send such a request. For those requests with an invalid `request-line` (it includes `request-target`), the spec [recommends to reject them with 400 or 301](https://datatracker.ietf.org/doc/html/rfc9112#section-3.2-4). The same can be said for HTTP 2 ([ref1](https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-2.4.1), [ref2](https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-3), [ref3](https://datatracker.ietf.org/doc/html/rfc9113#section-8.1.1-3)).\n\nOn Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of [`http.IncomingMessage.url`](https://nodejs.org/docs/latest-v22.x/api/http.html#messageurl) contains `#`. Vite assumed `req.url` won't contain `#` when checking `server.fs.deny`, allowing those kinds of requests to bypass the check.\n\nOn Deno, those requests are not rejected internally and is passed to the user land as well. But for those requests, the value of `http.IncomingMessage.url` did not contain `#`. \n\n### PoC\n```\nnpm create vite@latest\ncd vite-project/\nnpm install\nnpm run dev\n```\nsend request to read `/etc/passwd`\n```\ncurl --request-target /@fs/Users/doggy/Desktop/vite-project/#/../../../../../etc/passwd http://127.0.0.1:5173\n```", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "vite" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.2.0" + }, + { + "fixed": "6.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "vite" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.1.0" + }, + { + "fixed": "6.1.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "vite" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.0.15" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "vite" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0" + }, + { + "fixed": "5.4.18" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "vite" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.5.13" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vitejs/vite/security/advisories/GHSA-356w-63v5-8wf4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32395" + }, + { + "type": "WEB", + "url": "https://github.com/vitejs/vite/commit/175a83909f02d3b554452a7bd02b9f340cdfef70" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vitejs/vite" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T14:06:03Z", + "nvd_published_at": "2025-04-10T14:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-7r2v-8wxr-3ch5/GHSA-7r2v-8wxr-3ch5.json b/advisories/github-reviewed/2025/04/GHSA-7r2v-8wxr-3ch5/GHSA-7r2v-8wxr-3ch5.json new file mode 100644 index 00000000000..263965b8516 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-7r2v-8wxr-3ch5/GHSA-7r2v-8wxr-3ch5.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7r2v-8wxr-3ch5", + "modified": "2025-04-11T14:05:18Z", + "published": "2025-04-11T14:05:18Z", + "aliases": [ + "CVE-2025-32027" + ], + "summary": "Yii does not prevent XSS in scenarios where fallback error renderer is used", + "details": "### Impact\nAffected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used.\n\n### Patches\nUpgrade yiisoft/yii to version 1.1.31 or higher.\n\n### References\n- [Git commit](https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368)\n\nIf you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "yiisoft/yii" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.31" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32027" + }, + { + "type": "WEB", + "url": "https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368" + }, + { + "type": "PACKAGE", + "url": "https://github.com/yiisoft/yii" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T14:05:18Z", + "nvd_published_at": "2025-04-10T15:16:05Z" + } +} \ No newline at end of file