Skip to content

Commit 46d3f37

Browse files
rakviumpostmodern
rakvium
and
postmodern
authored
GHSA SYNC: new advisories (#873)
--------- Co-authored-by: Postmodern <postmodern.mod3@gmail.com>
1 parent 1f5c25f commit 46d3f37

File tree

8 files changed

+263
-0
lines changed

8 files changed

+263
-0
lines changed

‎gems/alchemy_cms/CVE-2018-18307.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
gem: alchemy_cms
3+
cve: 2018-18307
4+
ghsa: 7mj4-2984-955f
5+
url: https://nvd.nist.gov/vuln/detail/CVE-2018-18307
6+
title: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
7+
date: 2022-05-14
8+
description: |
9+
A stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS
10+
via the /admin/pictures image filename field.
11+
cvss_v3: 5.9
12+
unaffected_versions:
13+
- "< 4.1.0"
14+
notes: Never patched
15+
related:
16+
url:
17+
- https://nvd.nist.gov/vuln/detail/CVE-2018-18307
18+
- http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html
19+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15
20+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5
21+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21
22+
- https://github.com/advisories/GHSA-7mj4-2984-955f

‎gems/camaleon_cms/GHSA-3hp8-6j24-m5gm.yml

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
gem: camaleon_cms
3+
ghsa: 3hp8-6j24-m5gm
4+
url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
5+
title: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
6+
date: 2024-09-23
7+
description: |
8+
The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65) action might make arbitrary file writes (similar impact to GHSL-2024-182) for any authenticated user possible, but it doesn't seem to work currently.
9+
10+
Arbitrary file deletion can be exploited with following code path:
11+
The parameter folder flows from the actions method:
12+
```ruby
13+
def actions
14+
authorize! :manage, :media if params[:media_action] != 'crop_url'
15+
params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
16+
case params[:media_action]
17+
[..]
18+
when 'del_file'
19+
cama_uploader.delete_file(params[:folder].gsub('//', '/'))
20+
render plain: ''
21+
```
22+
into the method delete_file of the CamaleonCmsLocalUploader
23+
class (when files are uploaded locally):
24+
```ruby
25+
def delete_file(key)
26+
file = File.join(@root_folder, key)
27+
FileUtils.rm(file) if File.exist? file
28+
@instance.hooks_run('after_delete', key)
29+
get_media_collection.find_by_key(key).take.destroy
30+
end
31+
```
32+
Where it is joined in an unchecked manner with the root folder and
33+
then deleted.
34+
35+
## Proof of concept
36+
The following request would delete the file README.md in the top folder of the Ruby on Rails application. (The values for auth_token, X-CSRF-Token and _cms_session would also need to be replaced with authenticated values in the curl command below)
37+
```
38+
curl --path-as-is -i -s -k -X $'POST' \
39+
-H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
40+
-b $'auth_token=[..]; _cms_session=[..]' \
41+
--data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..
42+
2F..
43+
2F..
44+
2FREADME.md&media_action=del_file' \
45+
$'https://<camaleon-host>/admin/media/actions?actions=true'
46+
```
47+
48+
## Impact
49+
50+
This issue may lead to a defective CMS or system.
51+
52+
## Remediation
53+
54+
Normalize all file paths constructed from untrusted user input before using them and check that the resulting path is inside the
55+
targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.
56+
57+
## See also:
58+
59+
[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
60+
[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
61+
patched_versions:
62+
- ">= 2.8.1"
63+
related:
64+
url:
65+
- https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
66+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml
67+
- https://github.com/advisories/GHSA-3hp8-6j24-m5gm

‎gems/fluentd-ui/CVE-2020-21514.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
gem: fluentd-ui
3+
cve: 2020-21514
4+
ghsa: wrxf-x8rm-6ggg
5+
url: https://github.com/advisories/GHSA-wrxf-x8rm-6ggg
6+
title: Fluent Fluentd and Fluent-ui use default password
7+
date: 2023-04-04
8+
description: |
9+
An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
10+
that allows attackers to gain escilated privileges and execute arbitrary code due
11+
to use of a default password.
12+
cvss_v3: 8.8
13+
notes: Never patched
14+
related:
15+
url:
16+
- https://nvd.nist.gov/vuln/detail/CVE-2020-21514
17+
- https://github.com/fluent/fluentd/issues/2722
18+
- https://github.com/advisories/GHSA-wrxf-x8rm-6ggg

‎gems/fluentd/CVE-2020-21514.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
gem: fluentd
3+
cve: 2020-21514
4+
ghsa: wrxf-x8rm-6ggg
5+
url: https://github.com/advisories/GHSA-wrxf-x8rm-6ggg
6+
title: Fluent Fluentd and Fluent-ui use default password
7+
date: 2023-04-04
8+
description: |
9+
An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
10+
that allows attackers to gain escilated privileges and execute arbitrary code due
11+
to use of a default password.
12+
cvss_v3: 8.8
13+
notes: Never patched
14+
related:
15+
url:
16+
- https://nvd.nist.gov/vuln/detail/CVE-2020-21514
17+
- https://github.com/fluent/fluentd/issues/2722
18+
- https://github.com/advisories/GHSA-wrxf-x8rm-6ggg

‎gems/nokogiri/GHSA-vcc3-rw6f-jv97.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
gem: nokogiri
3+
ghsa: vcc3-rw6f-jv97
4+
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
5+
title: Use-after-free in libxml2 via Nokogiri::XML::Reader
6+
date: 2024-03-18
7+
description: |
8+
### Summary
9+
10+
Nokogiri upgrades its dependency libxml2 as follows:
11+
- v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
12+
- v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4
13+
14+
libxml2 v2.11.7 and v2.12.5 address the following vulnerability:
15+
16+
CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
17+
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
18+
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970
19+
20+
Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
21+
the packaged libraries are being used. If you've overridden defaults at installation time to use
22+
system libraries instead of packaged libraries, you should instead pay attention to your distro's
23+
libxml2 release announcements.
24+
25+
JRuby users are not affected.
26+
27+
### Severity
28+
29+
The Nokogiri maintainers have evaluated this as **Moderate**.
30+
31+
### Impact
32+
33+
From the CVE description, this issue applies to the `xmlTextReader` module (which underlies
34+
`Nokogiri::XML::Reader`):
35+
36+
> When using the XML Reader interface with DTD validation and XInclude expansion enabled,
37+
> processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
38+
39+
### Mitigation
40+
41+
Upgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.
42+
43+
Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
44+
and link Nokogiri against patched external libxml2 libraries which will also address these same
45+
issues.
46+
cvss_v3: 7.5
47+
patched_versions:
48+
- "~> 1.15.6"
49+
- ">= 1.16.2"
50+
related:
51+
url:
52+
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
53+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml
54+
- https://github.com/advisories/GHSA-vcc3-rw6f-jv97

‎gems/omniauth-saml/GHSA-hw46-3hmr-x9xv.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
gem: omniauth-saml
3+
ghsa: hw46-3hmr-x9xv
4+
url: https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
5+
title: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack
6+
issue
7+
date: 2025-03-12
8+
description: |-
9+
### Summary
10+
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
11+
12+
The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
13+
14+
Please [upgrade](https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16) the ruby-saml requirement to v1.18.0.
15+
16+
### Impact
17+
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
18+
cvss_v4: 9.3
19+
patched_versions:
20+
- "~> 1.10.6"
21+
- "~> 2.1.3"
22+
- ">= 2.2.3"
23+
related:
24+
url:
25+
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
26+
- https://github.com/omniauth/omniauth-saml/commit/0d5eaa0d808acb2ac96deadf5c750ac1cf2d92b5
27+
- https://github.com/omniauth/omniauth-saml/commit/2c8a482801808bbcb0188214bde74680b8018a35
28+
- https://github.com/omniauth/omniauth-saml/commit/7a348b49083462a566af41a5ae85e9f3af15b985
29+
- https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16
30+
- https://rubygems.org/gems/omniauth-saml/versions/2.2.3
31+
- https://github.com/advisories/GHSA-hw46-3hmr-x9xv

‎gems/user_agent_parser/GHSA-pcqq-5962-hvcw.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
gem: user_agent_parser
3+
ghsa: pcqq-5962-hvcw
4+
url: https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
5+
title: Denial of Service in uap-core when processing crafted User-Agent strings
6+
date: 2020-03-10
7+
description: |-
8+
### Impact
9+
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
10+
11+
### Patches
12+
Please update `uap-ruby` to &gt;= v2.6.0
13+
14+
### For more information
15+
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
16+
17+
Reported in `uap-core` by Ben Caller @bcaller
18+
patched_versions:
19+
- ">= 2.6.0"
20+
related:
21+
url:
22+
- https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
23+
- https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a
24+
- https://github.com/advisories/GHSA-pcqq-5962-hvcw

‎gems/webrick/CVE-2009-4492.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
gem: webrick
3+
cve: 2009-4492
4+
ghsa: 6mq2-37j5-w6r6
5+
url: https://github.com/advisories/GHSA-6mq2-37j5-w6r6
6+
title: WEBrick Improper Input Validation vulnerability
7+
date: 2017-10-24
8+
description: |
9+
WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel
10+
248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file
11+
without sanitizing non-printable characters, which might allow remote attackers
12+
to modify a window's title, or possibly execute arbitrary commands or overwrite
13+
files, via an HTTP request containing an escape sequence for a terminal emulator.
14+
cvss_v2: 7.5
15+
patched_versions:
16+
- ">= 1.4.0"
17+
related:
18+
url:
19+
- https://nvd.nist.gov/vuln/detail/CVE-2009-4492
20+
- https://github.com/advisories/GHSA-6mq2-37j5-w6r6
21+
- http://www.redhat.com/support/errata/RHSA-2011-0908.html
22+
- http://www.redhat.com/support/errata/RHSA-2011-0909.html
23+
- http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection
24+
- http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
25+
- https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089
26+
- https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949
27+
- https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429
28+
- https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded
29+
- https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710

0 commit comments

Comments
 (0)