Skip to content

Commit f7c8768

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-58c5-g7wp-6w37 GHSA-w88f-4875-99c8 GHSA-w88f-4875-99c8
1 parent 3e6e8be commit f7c8768

File tree

3 files changed

+189
-40
lines changed

3 files changed

+189
-40
lines changed

‎advisories/github-reviewed/2025/11/GHSA-58c5-g7wp-6w37/GHSA-58c5-g7wp-6w37.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-58c5-g7wp-6w37",
4+
"modified": "2025-11-26T23:18:50Z",
5+
"published": "2025-11-26T23:18:50Z",
6+
"aliases": [
7+
"CVE-2025-66035"
8+
],
9+
"summary": "Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client",
10+
"details": "The vulnerability is a **Credential Leak by App Logic** that leads to the **unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token** to an attacker-controlled domain.\n\nAngular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (`http://` or `https://`) to determine if it is cross-origin. If the URL starts with protocol-relative URL (`//`), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the `X-XSRF-TOKEN` header.\n\n### Impact\nThe token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.\n\n### Attack Preconditions\n1. The victim's Angular application must have **XSRF protection enabled**. \n2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`) to a **protocol-relative URL** (e.g., `//attacker.com`) that they control.\n\n### Patches\n- 19.2.16\n- 20.3.14\n- 21.0.1\n\n### Workarounds\nDevelopers should avoid using protocol-relative URLs (URLs starting with `//`) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single `/`) or fully qualified, trusted absolute URLs.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@angular/common"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "21.0.0-next.0"
29+
},
30+
{
31+
"fixed": "21.0.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "@angular/common"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "20.0.0-next.0"
48+
},
49+
{
50+
"fixed": "20.3.14"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "npm",
59+
"name": "@angular/common"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "19.2.16"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/angular/angular"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/angular/angular/releases/tag/19.2.16"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://github.com/angular/angular/releases/tag/20.3.14"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://github.com/angular/angular/releases/tag/21.0.1"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-201",
113+
"CWE-359"
114+
],
115+
"severity": "HIGH",
116+
"github_reviewed": true,
117+
"github_reviewed_at": "2025-11-26T23:18:50Z",
118+
"nvd_published_at": null
119+
}
120+
}

‎advisories/github-reviewed/2025/11/GHSA-w88f-4875-99c8/GHSA-w88f-4875-99c8.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w88f-4875-99c8",
4+
"modified": "2025-11-26T23:19:18Z",
5+
"published": "2025-11-26T09:31:21Z",
6+
"aliases": [
7+
"CVE-2025-59390"
8+
],
9+
"summary": "Apache Druid’s Kerberos authenticator uses a weak fallback secret",
10+
"details": "Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret`\n\nThis issue affects Apache Druid: through 34.0.0.\n\nUsers are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.druid:druid"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "35.0.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59390"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/apache/druid/pull/18368"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/apache/druid"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://lists.apache.org/thread/jwjltllnntgj1sb9wzsjmvwm9f8rlhg8"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "http://www.openwall.com/lists/oss-security/2025/11/26/1"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-338"
63+
],
64+
"severity": "CRITICAL",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-11-26T23:19:18Z",
67+
"nvd_published_at": "2025-11-26T09:15:46Z"
68+
}
69+
}

‎advisories/unreviewed/2025/11/GHSA-w88f-4875-99c8/GHSA-w88f-4875-99c8.json‎

Lines changed: 0 additions & 40 deletions
This file was deleted.

0 commit comments

Comments
 (0)