From d4c240ac89e4a21118837b44c7f47e418475b46a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 12 Nov 2024 21:29:43 +0000 Subject: [PATCH] Publish Advisories GHSA-4hjf-6pxr-549h GHSA-7hpf-g48v-hw3j GHSA-4hjf-6pxr-549h --- .../GHSA-4hjf-6pxr-549h.json | 130 ++++++++++++++++++ .../GHSA-7hpf-g48v-hw3j.json | 72 ++++++++++ .../GHSA-4hjf-6pxr-549h.json | 42 ------ 3 files changed, 202 insertions(+), 42 deletions(-) create mode 100644 advisories/github-reviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-7hpf-g48v-hw3j/GHSA-7hpf-g48v-hw3j.json delete mode 100644 advisories/unreviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json diff --git a/advisories/github-reviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json b/advisories/github-reviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json new file mode 100644 index 00000000000..620fd326eb5 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4hjf-6pxr-549h", + "modified": "2024-11-12T21:27:49Z", + "published": "2024-11-11T15:31:01Z", + "aliases": [ + "CVE-2024-43437" + ], + "summary": "Moodle Cross-site Scripting vulnerability", + "details": "A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.12" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43437" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304266" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=461207" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-81394" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-11-12T21:27:49Z", + "nvd_published_at": "2024-11-11T13:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-7hpf-g48v-hw3j/GHSA-7hpf-g48v-hw3j.json b/advisories/github-reviewed/2024/11/GHSA-7hpf-g48v-hw3j/GHSA-7hpf-g48v-hw3j.json new file mode 100644 index 00000000000..bc00b57432b --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-7hpf-g48v-hw3j/GHSA-7hpf-g48v-hw3j.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7hpf-g48v-hw3j", + "modified": "2024-11-12T21:28:26Z", + "published": "2024-11-12T21:28:25Z", + "aliases": [ + "CVE-2024-52010" + ], + "summary": "Zoraxy has an authenticated command injection in the Web SSH feature", + "details": "### Summary\nA command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host.\n\n### Details\nZoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers.\nIn [`HandleCreateProxySession`](https://github.com/tobychui/zoraxy/blob/9cb315ea6739d1cc201b690322d25166b12dc5db/src/webssh.go#L19) the request to create an SSH session is handled. After checking for the presence of required parameters, ensuring that the target is not the loopback interface and that there is actually an SSH service running on the target, `CreateNewConnection` is called:\n\nhttps://github.com/tobychui/zoraxy/blob/e79a70b7acfa45c2445aff9d60e4e7525c89fec8/src/mod/sshprox/sshprox.go#L165-L178\n\nIn line 178, the `gotty` binary is executed running `sshCommand` from the line above. It contains the user-controlled variable `connAddr`, which includes the hostname of the SSH server and - if provided - the username.\nAn attacker can exploit the `username` variable to escape from the `bash` command and inject arbitrary commands into `sshCommand`. This is possible, because, unlike hostname and port, the username is not validated or sanitized.\n\nThis vulnerability was introduced in https://github.com/tobychui/zoraxy/commit/c07d5f85dfc37bd32819358ed7d4bc32c604e8f0.\nIf Zoraxy is run without authentication of the management interface (started with`-noauth`), this vulnerability can be exploited without authentication.\nAdditionally, if Zoraxy is run in Docker with the Docker socket mounted (as described in https://github.com/tobychui/zoraxy/blob/9cb315ea6739d1cc201b690322d25166b12dc5db/docker/README.md), this vulnerability can be exploited to escape the Zoraxy container and gain access to the Docker host.\n\n### PoC\n1. Download and run Zoraxy as described in the [README](https://github.com/tobychui/zoraxy/blob/9a371f5bcbccce0918c61621f3b26ee549e01b90/README.md#standalone-mode)\n2. Setup a user\n3. Login as user\n4. Navigate to Other -> Network Tools -> Connection\n5. Enter hostname / IP of any server with SSH running, e.g. `github.com`\n6. Enter `; bash ;` as user\n7. Click `Connect using SSH`\n8. A window will open with `bash` running on the Zoraxy host\n\nDemo:\n\nhttps://github.com/user-attachments/assets/5a3d8771-167f-4a79-8665-ed0dfb490181\n\n### Impact\nThis vulnerability allows an authenticated attacker to gain remote code execution with the privileges of the Zoraxy process (root by default). This affects Zoraxy versions 2.6.1 through 3.1.2.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/tobychui/zoraxy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.1" + }, + { + "fixed": "3.1.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.1.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/tobychui/zoraxy/security/advisories/GHSA-7hpf-g48v-hw3j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52010" + }, + { + "type": "WEB", + "url": "https://github.com/tobychui/zoraxy/commit/2e9bc77a5d832bff1093058d42ce7a61382e4bc6" + }, + { + "type": "WEB", + "url": "https://github.com/tobychui/zoraxy/commit/c07d5f85dfc37bd32819358ed7d4bc32c604e8f0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/tobychui/zoraxy" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-12T21:28:25Z", + "nvd_published_at": "2024-11-12T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json b/advisories/unreviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json deleted file mode 100644 index 8e9b7e5f0eb..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-4hjf-6pxr-549h/GHSA-4hjf-6pxr-549h.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4hjf-6pxr-549h", - "modified": "2024-11-11T15:31:01Z", - "published": "2024-11-11T15:31:01Z", - "aliases": [ - "CVE-2024-43437" - ], - "details": "A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43437" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304266" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=461207" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-11T13:15:04Z" - } -} \ No newline at end of file