Skip to content

Commit b75f168

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-g85v-wf27-67xc GHSA-hw9x-8m75-4vjq GHSA-xcpr-7mr4-h4xq GHSA-xcpr-7mr4-h4xq
1 parent db41310 commit b75f168

File tree

4 files changed

+199
-42
lines changed

4 files changed

+199
-42
lines changed

‎advisories/github-reviewed/2024/11/GHSA-g85v-wf27-67xc/GHSA-g85v-wf27-67xc.json

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g85v-wf27-67xc",
4+
"modified": "2024-11-18T23:48:26Z",
5+
"published": "2024-11-18T23:48:26Z",
6+
"aliases": [
7+
"CVE-2024-52587"
8+
],
9+
"summary": "Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`",
10+
"details": "### Summary\n\nVersions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. \n\n### Details\n\n1. setup.ts:169 [1] performs `execSync` with a command that gets\ninvoked after interpretation by the shell. This command includes an\ninterpolated `process.env.USER` variable, which an attacker could\nmodify (without actually creating a new user) to inject arbitrary\nshell expressions into this `execSync`. This may or may not be likely\nin practice, but I believe the hygienic way to perform the underlying\noperation is to use `execFileSync` or similar and bypass the\nunderlying shell evaluation.\n\n2. setup.ts:229 [2] has a nearly identical `execSync` to (1) above,\nbut with `$USER` for shell-level interpolation rather than string\ninterpolation. However, this is still injectable and would be best\nreplaced by an `execFileSync`, per above.\n\n3. arc-runner:40-44 [3] has an `execSync` with multiple string\ninterpolations. Most of these do not appear immediately injectible\n(since they appear to come from presumed trusted API responses), but\nthe expansion of `getRunnerTempDir()` may be injectable due to its\ndependence on potentially attacker-controllable environment variables\n(e.g. `RUNNER_TEMP`). The underlying operation appears to be a trivial\nfile copy, so this entire subprocess should in theory be replaceable\nwith ordinary NodeJS `fs` API calls instead.\n\n4. arc-runner:53 [4] demonstrates the same weakness, and has the same\nresolution as (3).\n\n5. arc-runner:57 demonstrates the same weakness as (3) and (4), and\nhas the same resolution.\n\n6. arc-runner:61 demonstrates the same weakness as (3), (4), and (5),\nand has the same resolution.\n\n\n[1]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L169\n\n[2]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L229\n\n[3]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L40-L44\n\n[4]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L53\n\n[5]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L57\n\n[6]: https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L61",
11+
"severity": [
12+
13+
],
14+
"affected": [
15+
{
16+
"package": {
17+
"ecosystem": "GitHub Actions",
18+
"name": "step-security/harden-runner"
19+
},
20+
"ranges": [
21+
{
22+
"type": "ECOSYSTEM",
23+
"events": [
24+
{
25+
"introduced": "0"
26+
},
27+
{
28+
"fixed": "2.10.2"
29+
}
30+
]
31+
}
32+
]
33+
}
34+
],
35+
"references": [
36+
{
37+
"type": "WEB",
38+
"url": "https://github.com/step-security/harden-runner/security/advisories/GHSA-g85v-wf27-67xc"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/step-security/harden-runner/commit/0080882f6c36860b6ba35c610c98ce87d4e2f26f"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/step-security/harden-runner"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-78"
52+
],
53+
"severity": "LOW",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2024-11-18T23:48:26Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/unreviewed/2024/11/GHSA-hw9x-8m75-4vjq/GHSA-hw9x-8m75-4vjq.json renamed to ‎advisories/github-reviewed/2024/11/GHSA-hw9x-8m75-4vjq/GHSA-hw9x-8m75-4vjq.json

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hw9x-8m75-4vjq",
4-
"modified": "2024-11-18T18:30:48Z",
4+
"modified": "2024-11-18T23:48:11Z",
55
"published": "2024-11-12T21:30:55Z",
66
"aliases": [
77
"CVE-2024-51093"
88
],
9+
"summary": "Cross Site Scripting vulnerability in Snipe-IT",
910
"details": "Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the file /users/{{user-id}}/#files.",
1011
"severity": [
1112
{
@@ -14,7 +15,25 @@
1415
}
1516
],
1617
"affected": [
17-
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "snipe/snipe-it"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "7.0.13"
32+
}
33+
]
34+
}
35+
]
36+
}
1837
],
1938
"references": [
2039
{
@@ -24,15 +43,19 @@
2443
{
2544
"type": "WEB",
2645
"url": "https://gist.githubusercontent.com/Tommywarren/ca70f1c43f4ec34dc19cd13459535780/raw/d13192ae50bc7c024b922412dfa3f530faa8d5db/CVE-2024-51093"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/snipe/snipe-it"
2750
}
2851
],
2952
"database_specific": {
3053
"cwe_ids": [
3154
"CWE-79"
3255
],
3356
"severity": "HIGH",
34-
"github_reviewed": false,
35-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2024-11-18T23:48:11Z",
3659
"nvd_published_at": "2024-11-12T21:15:14Z"
3760
}
3861
}

‎advisories/github-reviewed/2024/11/GHSA-xcpr-7mr4-h4xq/GHSA-xcpr-7mr4-h4xq.json

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xcpr-7mr4-h4xq",
4+
"modified": "2024-11-18T23:48:03Z",
5+
"published": "2024-11-18T12:30:43Z",
6+
"aliases": [
7+
"CVE-2024-52316"
8+
],
9+
"summary": "Apache Tomcat - Authentication Bypass",
10+
"details": "Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.tomcat:tomcat-catalina"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "9.0.96"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.tomcat:tomcat-catalina"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "10.1.0-M1"
48+
},
49+
{
50+
"fixed": "10.1.30"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.apache.tomcat:tomcat-catalina"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.0.0-M1"
67+
},
68+
{
69+
"fixed": "11.0.1"
70+
}
71+
]
72+
}
73+
],
74+
"database_specific": {
75+
"last_known_affected_version_range": "<= 11.0.0-M26"
76+
}
77+
}
78+
],
79+
"references": [
80+
{
81+
"type": "ADVISORY",
82+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/apache/tomcat/commit/6d097a66746635df6880fe7662a792156b0eca14"
87+
},
88+
{
89+
"type": "WEB",
90+
"url": "https://github.com/apache/tomcat/commit/7532f9dc4a8c37ec958f79dc82c4924a6c539223"
91+
},
92+
{
93+
"type": "WEB",
94+
"url": "https://github.com/apache/tomcat/commit/acc2f01395f895980f5d8a64573fcc1bade13369"
95+
},
96+
{
97+
"type": "PACKAGE",
98+
"url": "https://github.com/apache/tomcat"
99+
},
100+
{
101+
"type": "WEB",
102+
"url": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"
103+
}
104+
],
105+
"database_specific": {
106+
"cwe_ids": [
107+
"CWE-391"
108+
],
109+
"severity": "CRITICAL",
110+
"github_reviewed": true,
111+
"github_reviewed_at": "2024-11-18T23:48:03Z",
112+
"nvd_published_at": "2024-11-18T12:15:18Z"
113+
}
114+
}

‎advisories/unreviewed/2024/11/GHSA-xcpr-7mr4-h4xq/GHSA-xcpr-7mr4-h4xq.json

Lines changed: 0 additions & 38 deletions
This file was deleted.

0 commit comments

Comments
 (0)