From f03e4b25a3dd8695743473d70ef7c58613134a61 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 23 Apr 2025 14:45:22 +0000 Subject: [PATCH] Publish Advisories GHSA-f69v-xrj8-rhxf GHSA-pmc3-p9hx-jq96 --- .../GHSA-f69v-xrj8-rhxf.json | 103 ++++++++++++++++++ .../GHSA-pmc3-p9hx-jq96.json | 67 ++++++++++++ 2 files changed, 170 insertions(+) create mode 100644 advisories/github-reviewed/2025/04/GHSA-f69v-xrj8-rhxf/GHSA-f69v-xrj8-rhxf.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-pmc3-p9hx-jq96/GHSA-pmc3-p9hx-jq96.json diff --git a/advisories/github-reviewed/2025/04/GHSA-f69v-xrj8-rhxf/GHSA-f69v-xrj8-rhxf.json b/advisories/github-reviewed/2025/04/GHSA-f69v-xrj8-rhxf/GHSA-f69v-xrj8-rhxf.json new file mode 100644 index 00000000000..220a2a45477 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-f69v-xrj8-rhxf/GHSA-f69v-xrj8-rhxf.json @@ -0,0 +1,103 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f69v-xrj8-rhxf", + "modified": "2025-04-23T14:42:42Z", + "published": "2025-04-23T14:42:42Z", + "aliases": [ + "CVE-2025-32969" + ], + "summary": "org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API", + "details": "### Impact\n\nIt is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when \"Prevent unregistered users from viewing pages, regardless of the page rights\" and \"Prevent unregistered users from editing pages, regardless of the page rights\" options are enabled.\n\nDepending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries.\n\nThe vulnerability may be tested in a default installation of XWIki Standard Flavor, including using the official Docker containers.\n\nAn example query, which leads to SQL injection with MySQL/MariaDB backend is shown below:\n\n```\ntime curl \"http://127.0.0.1:8080/rest/wikis/xwiki/query?q=where%20doc.name=length('a')*org.apache.logging.log4j.util.Chars.SPACE%20or%201%3C%3E%271%5C%27%27%20union%20select%201,2,3,sleep(10)%20%23%27&type=hql&distinct=0\"\n```\n\nWhen executed, the response from the server will come after a delay of 10 extra seconds, indicating successful execution of the injected SQL statement.\n\nAn example of a query for the PostgreSQL database backend is shown below:\n\n```\ncurl \"https://127.0.0.1:8080/rest/wikis/xwiki/query?q=where%20%24%24='%24%24=concat(%20chr(%2061%20),(chr(%2039%20))%20)%20;select%201%20--%20comment'&type=hql&distinct=0\"\n```\n\nBoth requests employ database backend dependent techniques of breaking out of HQL query context, described, for example, here: https://www.sonarsource.com/blog/exploiting-hibernate-injections.\n\n### Patches\n\nThis has been patched in 16.10.1, 16.4.6 and 15.10.16.\n\n### Workarounds\n\nThere is no known workaround, other than upgrading XWiki.\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-22691\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nSergey Anufrienko from Kaspersky ICS-CERT vulnerability research team reported this vulnerability.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-rest-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8" + }, + { + "fixed": "15.10.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-rest-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.0.0-rc-1" + }, + { + "fixed": "16.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.xwiki.platform:xwiki-platform-rest-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "16.5.0-rc-1" + }, + { + "fixed": "16.10.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f69v-xrj8-rhxf" + }, + { + "type": "WEB", + "url": "https://github.com/xwiki/xwiki-platform/commit/5c11a874bd24a581f534d283186e209bbccd8113" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwiki/xwiki-platform" + }, + { + "type": "WEB", + "url": "https://jira.xwiki.org/browse/XWIKI-22691" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-04-23T14:42:42Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-pmc3-p9hx-jq96/GHSA-pmc3-p9hx-jq96.json b/advisories/github-reviewed/2025/04/GHSA-pmc3-p9hx-jq96/GHSA-pmc3-p9hx-jq96.json new file mode 100644 index 00000000000..d2176d1f18c --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-pmc3-p9hx-jq96/GHSA-pmc3-p9hx-jq96.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pmc3-p9hx-jq96", + "modified": "2025-04-23T14:43:44Z", + "published": "2025-04-23T14:43:44Z", + "aliases": [], + "summary": "uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries", + "details": "### Description\nBefore version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version (e.g., TLS 1.2) by modifying the ClientHello message to exclude the SupportedVersions extension, causing the server to respond with a TLS 1.2 ServerHello (along with a downgrade canary in the ServerHello random field). Because utls did not check the downgrade canary in the ServerHello random field, clients would accept the downgraded connection without detecting the attack. This attack could also be used by an active network attacker to fingerprint utls connections.\n\n### Fix Commit or Pull Request\n\nrefraction-networking/utls#337, specifically refraction-networking/utls@f8892761e2a4d29054264651d3a86fda83bc83f9\n\n### References\n\n- https://github.com/refraction-networking/utls/issues/181", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/refraction-networking/utls" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/refraction-networking/utls/security/advisories/GHSA-pmc3-p9hx-jq96" + }, + { + "type": "WEB", + "url": "https://github.com/refraction-networking/utls/issues/181" + }, + { + "type": "WEB", + "url": "https://github.com/refraction-networking/utls/pull/337" + }, + { + "type": "WEB", + "url": "https://github.com/refraction-networking/utls/commit/f8892761e2a4d29054264651d3a86fda83bc83f9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/refraction-networking/utls" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-23T14:43:44Z", + "nvd_published_at": null + } +} \ No newline at end of file