diff --git a/advisories/github-reviewed/2025/05/GHSA-jqx4-9gpq-rppm/GHSA-jqx4-9gpq-rppm.json b/advisories/github-reviewed/2025/05/GHSA-jqx4-9gpq-rppm/GHSA-jqx4-9gpq-rppm.json new file mode 100644 index 00000000000..9943acb63d6 --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-jqx4-9gpq-rppm/GHSA-jqx4-9gpq-rppm.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jqx4-9gpq-rppm", + "modified": "2025-05-06T16:44:22Z", + "published": "2025-05-06T16:44:22Z", + "aliases": [], + "summary": "@misskey-dev/summaly allows IP Filter Bypass via Redirect", + "details": "### Summary\nDue to a validation error in `got.scpaping`, it is possible to use an HTTP redirect to avoid IP filtering.\n\n### Details\nIn `got.scpaping`, Summaly first makes a HTTP `HEAD` request to the page being summarized. It then preforms private IP address checks on the `HEAD` response, then makes an additional HTTP `GET` request to the page being summarized. Unfortunately, since private IP address checks aren't performed on the `GET` response, the `GET` response can issue a HTTP redirect to a private IP address, which will succeed, regardless of if private IP addresses are allowed by Summaly.\n\n### PoC\nWith a simple Caddy webserver, you can get Summaly to summarize a page hosted via a local IP address:\n```caddy\n@summaly-bypass-head {\n method HEAD\n path /summaly-bypass\n}\n@summaly-bypass-get {\n method GET\n path /summaly-bypass\n}\nheader @summaly-bypass-head Content-Type \"text/html\"\nrespond @summaly-bypass-head 200\nredir @summaly-bypass-get http://127.0.0.1:3080/\n```\n\n### Impact\nUsing this bypass, an attacker can probe a victims internal network for HTTP services that aren't supposed to be exposed to the outside world. While they might only have read-only access through this, it may still be possible to extract sensitive information or be used to probe a network prior to attacking via other exploits without leaving a trace.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@misskey-dev/summaly" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.1.0" + }, + { + "fixed": "5.2.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/misskey-dev/summaly/security/advisories/GHSA-jqx4-9gpq-rppm" + }, + { + "type": "WEB", + "url": "https://github.com/misskey-dev/summaly/commit/dfe6451012aac42eabe71d4ed721d8058c4066b4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/misskey-dev/summaly" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-346" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-06T16:44:22Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-m2xr-2vj4-wh94/GHSA-m2xr-2vj4-wh94.json b/advisories/github-reviewed/2025/05/GHSA-m2xr-2vj4-wh94/GHSA-m2xr-2vj4-wh94.json new file mode 100644 index 00000000000..222d70439eb --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-m2xr-2vj4-wh94/GHSA-m2xr-2vj4-wh94.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2xr-2vj4-wh94", + "modified": "2025-05-06T16:44:30Z", + "published": "2025-05-06T16:44:30Z", + "aliases": [], + "summary": "tanton_engine has unsound public API", + "details": "The following functions in the `tanton_engine` crate are unsound due to lack of sufficient boundary\nchecks in public API:\n\n- `Stack::offset()`\n- `ThreadStack::get()`\n- `RootMoveList::insert_score_depth()`\n- `RootMoveList::insert_score()`\n\nThe tanton_engine crate is no longer maintained, so there are no plans to fix this issue.", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "tanton_engine" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0031.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-06T16:44:30Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-rwj2-w85g-5cmm/GHSA-rwj2-w85g-5cmm.json b/advisories/github-reviewed/2025/05/GHSA-rwj2-w85g-5cmm/GHSA-rwj2-w85g-5cmm.json new file mode 100644 index 00000000000..27dacba584d --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-rwj2-w85g-5cmm/GHSA-rwj2-w85g-5cmm.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rwj2-w85g-5cmm", + "modified": "2025-05-06T16:45:17Z", + "published": "2025-05-06T16:45:17Z", + "aliases": [ + "CVE-2025-46816" + ], + "summary": "goshs route not protected, allows command execution", + "details": "### Summary\n\nIt seems that when running **goshs** without arguments it is possible for anyone to execute commands on the server. This was tested on version **1.0.4** of **goshs**. The command function was introduced in version **0.3.4**.\n\n### Details\n\nIt seems that the function ```dispatchReadPump``` does not checks the option cli ```-c```, thus allowing anyone to execute arbitrary command through the use of websockets.\n\n### PoC\n\nUsed **websocat** for the POC:\n```bash\necho -e '{\"type\": \"command\", \"content\": \"id\"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t\n```\n\n### Impact\n\nThe vulnerability will only impacts goshs server on vulnerable versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/patrickhener/goshs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.3.4" + }, + { + "fixed": "1.0.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.0.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmm" + }, + { + "type": "WEB", + "url": "https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfa" + }, + { + "type": "PACKAGE", + "url": "https://github.com/patrickhener/goshs" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284", + "CWE-77" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-05-06T16:45:17Z", + "nvd_published_at": null + } +} \ No newline at end of file