Publish Advisories

GHSA-jqx4-9gpq-rppm GHSA-m2xr-2vj4-wh94 GHSA-rwj2-w85g-5cmm
2026-05-22 18:04:22 -07:00 · 2025-05-06 16:46:39 +00:00
parent c2b8619b46
commit ea2620e4f7
3 changed files with 170 additions and 0 deletions
@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jqx4-9gpq-rppm",
+  "modified": "2025-05-06T16:44:22Z",
+  "published": "2025-05-06T16:44:22Z",
+  "aliases": [],
+  "summary": "@misskey-dev/summaly allows IP Filter Bypass via Redirect",
+  "details": "### Summary\nDue to a validation error in `got.scpaping`, it is possible to use an HTTP redirect to avoid IP filtering.\n\n### Details\nIn `got.scpaping`, Summaly first makes a HTTP `HEAD` request to the page being summarized. It then preforms private IP address checks on the `HEAD` response, then makes an additional HTTP `GET` request to the page being summarized. Unfortunately, since private IP address checks aren't performed on the `GET` response, the `GET` response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.\n\n### PoC\nWith a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:\n```caddy\n@summaly-bypass-head {\n    method HEAD\n    path /summaly-bypass\n}\n@summaly-bypass-get {\n    method GET\n    path /summaly-bypass\n}\nheader @summaly-bypass-head Content-Type \"text/html\"\nrespond @summaly-bypass-head 200\nredir @summaly-bypass-get http://127.0.0.1:3080/\n```\n\n### Impact\nUsing this bypass, an attacker can probe a victims internal network for HTTP services that aren't supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@misskey-dev/summaly"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.1.0"
+            },
+            {
+              "fixed": "5.2.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/misskey-dev/summaly/security/advisories/GHSA-jqx4-9gpq-rppm"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/misskey-dev/summaly/commit/dfe6451012aac42eabe71d4ed721d8058c4066b4"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/misskey-dev/summaly"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-346"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-06T16:44:22Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m2xr-2vj4-wh94",
+  "modified": "2025-05-06T16:44:30Z",
+  "published": "2025-05-06T16:44:30Z",
+  "aliases": [],
+  "summary": "tanton_engine has unsound public API",
+  "details": "The following functions in the `tanton_engine` crate are unsound due to lack of sufficient boundary\nchecks in public API:\n\n- `Stack::offset()`\n- `ThreadStack::get()`\n- `RootMoveList::insert_score_depth()`\n- `RootMoveList::insert_score()`\n\nThe tanton_engine crate is no longer maintained, so there are no plans to fix this issue.",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "tanton_engine"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.0.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0031.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-06T16:44:30Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rwj2-w85g-5cmm",
+  "modified": "2025-05-06T16:45:17Z",
+  "published": "2025-05-06T16:45:17Z",
+  "aliases": [
+    "CVE-2025-46816"
+  ],
+  "summary": "goshs route not protected, allows command execution",
+  "details": "### Summary\n\nIt seems that when running **goshs** without arguments it is possible for anyone to execute commands on the server. This was tested on version **1.0.4** of **goshs**. The command function was introduced in version **0.3.4**.\n\n### Details\n\nIt seems that the function ```dispatchReadPump``` does not checks the option cli ```-c```, thus allowing anyone to execute arbitrary command through the use of websockets.\n\n### PoC\n\nUsed **websocat** for the POC:\n```bash\necho -e '{\"type\": \"command\", \"content\": \"id\"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t\n```\n\n### Impact\n\nThe vulnerability will only impacts goshs server on vulnerable versions.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/patrickhener/goshs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.3.4"
+            },
+            {
+              "fixed": "1.0.5"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.0.4"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmm"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfa"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/patrickhener/goshs"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284",
+      "CWE-77"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-06T16:45:17Z",
+    "nvd_published_at": null
+  }
+}