From f50395bfb0165897f562f98c0b18105791b442d8 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 5 Aug 2024 19:50:34 +0000 Subject: [PATCH] Publish Advisories GHSA-cxgv-px37-4mp2 GHSA-rcvg-rgf7-pppv GHSA-v784-fjjh-f8r4 GHSA-vf6r-87q4-2vjf --- .../GHSA-cxgv-px37-4mp2.json | 68 ++++++++++++++++++ .../GHSA-rcvg-rgf7-pppv.json | 69 +++++++++++++++++++ .../GHSA-v784-fjjh-f8r4.json | 69 +++++++++++++++++++ .../GHSA-vf6r-87q4-2vjf.json | 61 ++++++++++++++++ 4 files changed, 267 insertions(+) create mode 100644 advisories/github-reviewed/2024/08/GHSA-cxgv-px37-4mp2/GHSA-cxgv-px37-4mp2.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-rcvg-rgf7-pppv/GHSA-rcvg-rgf7-pppv.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-v784-fjjh-f8r4/GHSA-v784-fjjh-f8r4.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-vf6r-87q4-2vjf/GHSA-vf6r-87q4-2vjf.json diff --git a/advisories/github-reviewed/2024/08/GHSA-cxgv-px37-4mp2/GHSA-cxgv-px37-4mp2.json b/advisories/github-reviewed/2024/08/GHSA-cxgv-px37-4mp2/GHSA-cxgv-px37-4mp2.json new file mode 100644 index 00000000000..c0b2e4f88eb --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-cxgv-px37-4mp2/GHSA-cxgv-px37-4mp2.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cxgv-px37-4mp2", + "modified": "2024-08-05T19:49:55Z", + "published": "2024-08-05T19:49:55Z", + "aliases": [ + "CVE-2024-42352" + ], + "summary": "Nuxt Icon affected by a Server-Side Request Forgery (SSRF)", + "details": "### Summary\n`nuxt/icon` provides an API to allow client side icon lookup. This endpoint is at `/api/_nuxt_icon/[name]`.\n\nThe proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure.\n\n### Details\nThe `new URL` constructor is used to parse the final path. This constructor can be passed a relative scheme or path in order to change the host the request is sent to. This constructor is also very tolerant of poorly formatted URLs.\n\nAs a result we can pass a path prefixed with the string `http:`. This has the effect of changing the scheme to HTTP. We can then subsequently pass a new host, for example `http:127.0.0.1:8080`. This would allow us to send requests to a local server. \n\n### PoC\nMake a request to `/api/_nuxt_icon/http:example.com`, observe the data returned has been fetched from a different resource than intended. \n\nI typically try to find an example within Nuxt infrastructure that is vulnerable to these types of bugs, but I could not identify any with this endpoint enabled.\n\n### Impact\n+ SSRF, potential sensitive data exposure.\n+ I do not believe this can be chained into an XSS, but it may be possible.\n+ Does not have a security impact on services deployed on Cloudflare Workers.\n+ Does not impact certain builds and modes (like static builds).\n+ Can be mitigated using by disabling the `fallbackToApi` option.\n\n### Fix\n+ Ensure the host has not been changed after the path is parsed.\n+ Alternatively, prefix the path with `./`.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@nuxt/icon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.4.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nuxt/icon/security/advisories/GHSA-cxgv-px37-4mp2" + }, + { + "type": "WEB", + "url": "https://github.com/nuxt/icon/commit/4564518c2b2ed8235a7715056ccdfce96ca3d0ff" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nuxt/icon" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T19:49:55Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-rcvg-rgf7-pppv/GHSA-rcvg-rgf7-pppv.json b/advisories/github-reviewed/2024/08/GHSA-rcvg-rgf7-pppv/GHSA-rcvg-rgf7-pppv.json new file mode 100644 index 00000000000..a9e3790848d --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-rcvg-rgf7-pppv/GHSA-rcvg-rgf7-pppv.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcvg-rgf7-pppv", + "modified": "2024-08-05T19:48:56Z", + "published": "2024-08-05T19:48:56Z", + "aliases": [ + "CVE-2024-23657" + ], + "summary": "Nuxt Devtools has a Path Traversal: '../filedir'", + "details": "### Summary\nNuxt Devtools is missing authentication on the `getTextAssetContent` RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the WebSocket handler, an attacker is able to interact with a locally running devtools instance and exfiltrate data abusing this vulnerability. \n\nIn certain configurations an attacker could leak the devtools authentication token and then abuse other RPC functions to achieve RCE. \n\n### Details\nThe `getTextAssetContent` function does not check for path traversals [(source)](https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L88C48-L88C48), this could allow an attacker to read arbitrary files over the RPC WebSocket. \n\nThe WebSocket server does not check the origin of the request [(source)](https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/index.ts#L109) leading to [CSWSH](https://portswigger.net/web-security/websockets/cross-site-websocket-hijacking). This may be intentional to allow certain configurations to work correctly.\n\nNuxt Devtools authentication tokens are placed within the home directory of the current user [(source)](https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/dev-auth.ts#L14).\n\nIn the scenario that:\n + The user has a Nuxt3 Project running\n + Devtools is enabled and running\n + The project is placed within the users home directory.\n + The user visits a malicious webpage\n + User has authenticated with devtools at least once\n\nThe malicious webpage can connect to the Devtools WebSocket, perform a directory traversal brute force to find the authentication token, then use the *authenticated* [`writeStaticAssets` function](https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L96C11-L96C28) to create a new Component, Nitro Handler or `app.vue` file which will run automatically as the file is changed.\n\n### PoC\nPOC will exploit the Devtools server on localhost:3000 (you may need to manually restart the server as the restart hook does not always work).\n\nPOC: https://devtools-exploit.pages.dev\n\n1. Create a new project with nuxt.new.\n2. Place the project inside your home directory.\n3. Run `pnpm run dev`.\n4. Open the POC page.\n\nThe POC will:\n+ Identify devtools version.\n+ Leak your devtools token.\n+ Create a new server handler with an insecure eval.\n\n### Impact\n+ All new Nuxt projects by default (devtools is enabled) are vulnerable to arbitrary file read.\n+ Certain Nuxt configurations are vulnerable to Remote Code Execution\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@nuxt/devtools" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-rcvg-rgf7-pppv" + }, + { + "type": "WEB", + "url": "https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/assets.ts#L88C48-L88C48" + }, + { + "type": "WEB", + "url": "https://github.com/nuxt/devtools/blob/c4f2b68281203fc3f61ffc97d9c6623fbfde46bb/packages/devtools/src/server-rpc/index.ts#L109" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nuxt/nuxt" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-24" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T19:48:56Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-v784-fjjh-f8r4/GHSA-v784-fjjh-f8r4.json b/advisories/github-reviewed/2024/08/GHSA-v784-fjjh-f8r4/GHSA-v784-fjjh-f8r4.json new file mode 100644 index 00000000000..874f291914e --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-v784-fjjh-f8r4/GHSA-v784-fjjh-f8r4.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v784-fjjh-f8r4", + "modified": "2024-08-05T19:49:45Z", + "published": "2024-08-05T19:49:45Z", + "aliases": [ + "CVE-2024-34344" + ], + "summary": "Nuxt vulnerable to remote code execution via the browser when running the test locally", + "details": "### Summary\nDue to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands.\n\n### Details\nWhile running the test, a special component named `NuxtTestComponentWrapper` is available.\nhttps://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/nuxt-root.vue#L42-L43\n\nThis component loads the specified path as a component and renders it.\n\nhttps://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27\n\nThere is a validation for the `path` parameter to check whether the path traversal is performed, but this check is not sufficient.\n\nhttps://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19\n\nSince `import(...)` uses `query.path` instead of the normalized `path`, a non-normalized URL can reach the `import(...)` function.\nFor example, passing something like `./components/test` normalizes `path` to `/root/directory/components/test`, but `import(...)` still receives `./components/test`.\n\nBy using this behavior, it's possible to load arbitrary JavaScript by using the path like the following:\n```\ndata:text/javascript;base64,Y29uc29sZS5sb2coMSk\n```\n\nSince `resolve(...)` resolves the filesystem path, not the URI, the above URI is treated as a relative path, but `import(...)` sees it as an absolute URI, and loads it as a JavaScript.\n\n### PoC\n1. Create a nuxt project and run it in the test mode:\n```\nnpx nuxi@latest init test\ncd test\nTEST=true npm run dev\n```\n2. Open the following URL:\n```\nhttp://localhost:3000/__nuxt_component_test__/?path=data%3Atext%2Fjavascript%3Bbase64%2CKGF3YWl0IGltcG9ydCgnZnMnKSkud3JpdGVGaWxlU3luYygnL3RtcC90ZXN0JywgKGF3YWl0IGltcG9ydCgnY2hpbGRfcHJvY2VzcycpKS5zcGF3blN5bmMoIndob2FtaSIpLnN0ZG91dCwgJ3V0Zi04Jyk\n```\n3. Confirm that the output of `whoami` is written to `/tmp/test`\n\nDemonstration video: https://www.youtube.com/watch?v=FI6mN8WbcE4\n\n### Impact\nUsers who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page.\nSince web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "nuxt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4.0" + }, + { + "fixed": "3.12.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-v784-fjjh-f8r4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nuxt/nuxt" + }, + { + "type": "WEB", + "url": "https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L15-L19" + }, + { + "type": "WEB", + "url": "https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/test-component-wrapper.ts#L9-L27" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-706" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T19:49:45Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-vf6r-87q4-2vjf/GHSA-vf6r-87q4-2vjf.json b/advisories/github-reviewed/2024/08/GHSA-vf6r-87q4-2vjf/GHSA-vf6r-87q4-2vjf.json new file mode 100644 index 00000000000..b741db3970e --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-vf6r-87q4-2vjf/GHSA-vf6r-87q4-2vjf.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vf6r-87q4-2vjf", + "modified": "2024-08-05T19:49:22Z", + "published": "2024-08-05T19:49:22Z", + "aliases": [ + "CVE-2024-34343" + ], + "summary": "nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR", + "details": "### Summary\nThe `navigateTo` function attempts to blockthe `javascript:` protocol, but does not correctly use API's provided by `unjs/ufo`. This library also contains parsing discrepancies.\n\n### Details\nThe function first tests to see if the specified [URL has a protocol](https://github.com/nuxt/nuxt/blob/fa9d43753d25fc2e8c3107f194b2bab6d4ebcb9a/packages/nuxt/src/app/composables/router.ts#L142). This uses the [unjs/ufo](https://github.com/unjs/ufo) package for URL parsing. This function works effectively, and returns true for a `javascript:` protocol.\n\nAfter this, the URL is parsed using the [`parseURL`](https://github.com/unjs/ufo/blob/e970686b2acae972136f478732450f6a2f1ab5e5/src/parse.ts#L47) function. This function will refuse to parse poorly formatted URLs. Parsing `javascript:alert(1)` returns null/\"\" for all values. \n\nNext, the protocol of the URL is then checked using the [`isScriptProtocol`](https://github.com/unjs/ufo/blob/e970686b2acae972136f478732450f6a2f1ab5e5/src/utils.ts#L74) function. This function simply checks the input against a list of protocols, and does not perform any parsing. \n\nThe combination of refusing to parse poorly formatted URLs, and not performing additional parsing means that script checks fail as no protocol can be found. Even if a protocol was identified, whitespace is not stripped in the `parseURL` implementation, bypassing the `isScriptProtocol` checks. \n\nCertain special protocols are identified at the top of [`parseURL`](https://github.com/unjs/ufo/blob/e970686b2acae972136f478732450f6a2f1ab5e5/src/parse.ts#L49). Inserting a newline or tab into this sequence will block the special protocol check, and bypass the latter checks. \n\n### PoC\nPOC - https://stackblitz.com/edit/nuxt-xss-navigateto?file=app.vue\n\nAttempt payload X, then attempt payload Y.\n\n### Impact\nXSS, access to cookies, make requests on user's behalf. \n\n### Recommendations\nAs always with these bugs, the `URL` constructor provided by the browser is always the safest method of parsing a URL. \n\nGiven the cross-platform requirements of nuxt/ufo a more appropriate solution is to make parsing consistent between functions, and to adapt parsing to be more consistent with the [WHATWG URL specification](https://url.spec.whatwg.org/).\n\n### Note\nI've reported this vulnerability here as it is unclear if this is a bug in ufo or a misuse of the ufo library.\n\nThis ONLY has impact after SSR has occured, the `javascript:` protocol within a location header does not trigger XSS.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "nuxt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.12.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-vf6r-87q4-2vjf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nuxt/nuxt" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-83" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T19:49:22Z", + "nvd_published_at": null + } +} \ No newline at end of file