Skip to content

Commit f25af2c

Browse files
rakviumRubySec CI
rakvium
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@46d3f37 
1 parent 129540d commit f25af2c

7 files changed

+251
-16
lines changed

‎advisories/_posts/2017-10-24-CVE-2009-4492.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2009-4492 (webrick): WEBrick Improper Input Validation vulnerability'
4+
comments: false
5+
categories:
6+
- webrick
7+
advisory:
8+
gem: webrick
9+
cve: 2009-4492
10+
ghsa: 6mq2-37j5-w6r6
11+
url: https://github.com/advisories/GHSA-6mq2-37j5-w6r6
12+
title: WEBrick Improper Input Validation vulnerability
13+
date: 2017-10-24
14+
description: |
15+
WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel
16+
248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file
17+
without sanitizing non-printable characters, which might allow remote attackers
18+
to modify a window's title, or possibly execute arbitrary commands or overwrite
19+
files, via an HTTP request containing an escape sequence for a terminal emulator.
20+
cvss_v2: 7.5
21+
patched_versions:
22+
- ">= 1.4.0"
23+
related:
24+
url:
25+
- https://nvd.nist.gov/vuln/detail/CVE-2009-4492
26+
- https://github.com/advisories/GHSA-6mq2-37j5-w6r6
27+
- http://www.redhat.com/support/errata/RHSA-2011-0908.html
28+
- http://www.redhat.com/support/errata/RHSA-2011-0909.html
29+
- http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection
30+
- http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
31+
- https://web.archive.org/web/20100113155532/http://www.vupen.com/english/advisories/2010/0089
32+
- https://web.archive.org/web/20100815010948/http://secunia.com/advisories/37949
33+
- https://web.archive.org/web/20170402100552/http://securitytracker.com/id?1023429
34+
- https://web.archive.org/web/20170908140655/http://www.securityfocus.com/archive/1/508830/100/0/threaded
35+
- https://web.archive.org/web/20200228145937/http://www.securityfocus.com/bid/37710
36+
---

‎advisories/_posts/2020-03-10-GHSA-pcqq-5962-hvcw.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-pcqq-5962-hvcw (user_agent_parser): Denial of Service in uap-core when
4+
processing crafted User-Agent strings'
5+
comments: false
6+
categories:
7+
- user_agent_parser
8+
advisory:
9+
gem: user_agent_parser
10+
ghsa: pcqq-5962-hvcw
11+
url: https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
12+
title: Denial of Service in uap-core when processing crafted User-Agent strings
13+
date: 2020-03-10
14+
description: |-
15+
### Impact
16+
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
17+
18+
### Patches
19+
Please update `uap-ruby` to >= v2.6.0
20+
21+
### For more information
22+
https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p
23+
24+
Reported in `uap-core` by Ben Caller @bcaller
25+
patched_versions:
26+
- ">= 2.6.0"
27+
related:
28+
url:
29+
- https://github.com/ua-parser/uap-ruby/security/advisories/GHSA-pcqq-5962-hvcw
30+
- https://github.com/ua-parser/uap-ruby/commit/2bb18268f4c5ba7d4ba0e21c296bf6437063da3a
31+
- https://github.com/advisories/GHSA-pcqq-5962-hvcw
32+
---

‎advisories/_posts/2022-05-14-CVE-2018-18307.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2018-18307 (alchemy_cms): AlchemyCMS is vulnerable to stored XSS via the
4+
/admin/pictures image field'
5+
comments: false
6+
categories:
7+
- alchemy_cms
8+
advisory:
9+
gem: alchemy_cms
10+
cve: 2018-18307
11+
ghsa: 7mj4-2984-955f
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2018-18307
13+
title: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
14+
date: 2022-05-14
15+
description: |
16+
A stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS
17+
via the /admin/pictures image filename field.
18+
cvss_v3: 5.9
19+
unaffected_versions:
20+
- "< 4.1.0"
21+
notes: Never patched
22+
related:
23+
url:
24+
- https://nvd.nist.gov/vuln/detail/CVE-2018-18307
25+
- http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html
26+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15
27+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5
28+
- https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21
29+
- https://github.com/advisories/GHSA-7mj4-2984-955f
30+
---

‎advisories/_posts/2023-04-04-CVE-2020-21514.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2020-21514 (fluentd): Fluent Fluentd and Fluent-ui use default password'
4+
comments: false
5+
categories:
6+
- fluentd
7+
advisory:
8+
gem: fluentd
9+
cve: 2020-21514
10+
ghsa: wrxf-x8rm-6ggg
11+
url: https://github.com/advisories/GHSA-wrxf-x8rm-6ggg
12+
title: Fluent Fluentd and Fluent-ui use default password
13+
date: 2023-04-04
14+
description: |
15+
An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2
16+
that allows attackers to gain escilated privileges and execute arbitrary code due
17+
to use of a default password.
18+
cvss_v3: 8.8
19+
notes: Never patched
20+
related:
21+
url:
22+
- https://nvd.nist.gov/vuln/detail/CVE-2020-21514
23+
- https://github.com/fluent/fluentd/issues/2722
24+
- https://github.com/advisories/GHSA-wrxf-x8rm-6ggg
25+
---

‎advisories/_posts/2024-03-18-GHSA-vcc3-rw6f-jv97.md

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ advisory:
1010
url: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
1111
title: Use-after-free in libxml2 via Nokogiri::XML::Reader
1212
date: 2024-03-18
13-
description: |2
14-
13+
description: |
1514
### Summary
1615
1716
Nokogiri upgrades its dependency libxml2 as follows:
@@ -24,11 +23,10 @@ advisory:
2423
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
2524
- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970
2625
27-
Please note that this advisory only applies to the CRuby implementation
28-
of Nokogiri, and only if the packaged libraries are being used. If
29-
you've overridden defaults at installation time to use system libraries
30-
instead of packaged libraries, you should instead pay attention to
31-
your distro's libxml2 release announcements.
26+
Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
27+
the packaged libraries are being used. If you've overridden defaults at installation time to use
28+
system libraries instead of packaged libraries, you should instead pay attention to your distro's
29+
libxml2 release announcements.
3230
3331
JRuby users are not affected.
3432
@@ -38,26 +36,26 @@ advisory:
3836
3937
### Impact
4038
41-
From the CVE description, this issue applies to the `xmlTextReader`
42-
module (which underlies `Nokogiri::XML::Reader`):
39+
From the CVE description, this issue applies to the `xmlTextReader` module (which underlies
40+
`Nokogiri::XML::Reader`):
4341
44-
> When using the XML Reader interface with DTD validation and
45-
> XInclude expansion enabled, processing crafted XML documents
46-
> can lead to an xmlValidatePopElement use-after-free.
42+
> When using the XML Reader interface with DTD validation and XInclude expansion enabled,
43+
> processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.
4744
4845
### Mitigation
4946
5047
Upgrade to Nokogiri `~> 1.15.6` or `>= 1.16.2`.
5148
52-
Users who are unable to upgrade Nokogiri may also choose a more
53-
complicated mitigation: compile and link Nokogiri against patched
54-
external libxml2 libraries which will also address these same issues.
49+
Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
50+
and link Nokogiri against patched external libxml2 libraries which will also address these same
51+
issues.
52+
cvss_v3: 7.5
5553
patched_versions:
5654
- "~> 1.15.6"
5755
- ">= 1.16.2"
5856
related:
5957
url:
6058
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j
61-
- https://vulners.com/github/GHSA-VCC3-RW6F-JV97
59+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml
6260
- https://github.com/advisories/GHSA-vcc3-rw6f-jv97
6361
---

‎advisories/_posts/2024-09-23-GHSA-3hp8-6j24-m5gm.md

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-3hp8-6j24-m5gm (camaleon_cms): Camaleon CMS vulnerable to remote code
4+
execution through code injection (GHSL-2024-185)'
5+
comments: false
6+
categories:
7+
- camaleon_cms
8+
advisory:
9+
gem: camaleon_cms
10+
ghsa: 3hp8-6j24-m5gm
11+
url: https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
12+
title: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
13+
date: 2024-09-23
14+
description: |
15+
The [actions](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L51-L52) defined inside of the MediaController class do not check whether a given path is inside a certain path (e.g. inside the media folder). If an attacker performed an account takeover of an administrator account (See: GHSL-2024-184) they could delete arbitrary files or folders on the server hosting Camaleon CMS. The [crop_url](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L64-L65) action might make arbitrary file writes (similar impact to GHSL-2024-182) for any authenticated user possible, but it doesn't seem to work currently.
16+
17+
Arbitrary file deletion can be exploited with following code path:
18+
The parameter folder flows from the actions method:
19+
```ruby
20+
def actions
21+
authorize! :manage, :media if params[:media_action] != 'crop_url'
22+
params[:folder] = params[:folder].gsub('//', '/') if params[:folder].present?
23+
case params[:media_action]
24+
[..]
25+
when 'del_file'
26+
cama_uploader.delete_file(params[:folder].gsub('//', '/'))
27+
render plain: ''
28+
```
29+
into the method delete_file of the CamaleonCmsLocalUploader
30+
class (when files are uploaded locally):
31+
```ruby
32+
def delete_file(key)
33+
file = File.join(@root_folder, key)
34+
FileUtils.rm(file) if File.exist? file
35+
@instance.hooks_run('after_delete', key)
36+
get_media_collection.find_by_key(key).take.destroy
37+
end
38+
```
39+
Where it is joined in an unchecked manner with the root folder and
40+
then deleted.
41+
42+
## Proof of concept
43+
The following request would delete the file README.md in the top folder of the Ruby on Rails application. (The values for auth_token, X-CSRF-Token and _cms_session would also need to be replaced with authenticated values in the curl command below)
44+
```
45+
curl --path-as-is -i -s -k -X $'POST' \
46+
-H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \
47+
-b $'auth_token=[..]; _cms_session=[..]' \
48+
--data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=..
49+
2F..
50+
2F..
51+
2FREADME.md&media_action=del_file' \
52+
$'https://<camaleon-host>/admin/media/actions?actions=true'
53+
```
54+
55+
## Impact
56+
57+
This issue may lead to a defective CMS or system.
58+
59+
## Remediation
60+
61+
Normalize all file paths constructed from untrusted user input before using them and check that the resulting path is inside the
62+
targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.
63+
64+
## See also:
65+
66+
[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
67+
[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
68+
patched_versions:
69+
- ">= 2.8.1"
70+
related:
71+
url:
72+
- https://github.com/owen2345/camaleon-cms/security/advisories/GHSA-7x4w-cj9r-h4v9
73+
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml
74+
- https://github.com/advisories/GHSA-3hp8-6j24-m5gm
75+
---

‎advisories/_posts/2025-03-12-GHSA-hw46-3hmr-x9xv.md

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-hw46-3hmr-x9xv (omniauth-saml): omniauth-saml has dependency on ruby-saml
4+
version with Signature Wrapping Attack issue'
5+
comments: false
6+
categories:
7+
- omniauth-saml
8+
advisory:
9+
gem: omniauth-saml
10+
ghsa: hw46-3hmr-x9xv
11+
url: https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
12+
title: omniauth-saml has dependency on ruby-saml version with Signature Wrapping
13+
Attack issue
14+
date: 2025-03-12
15+
description: |-
16+
### Summary
17+
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.
18+
19+
The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.
20+
21+
Please [upgrade](https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16) the ruby-saml requirement to v1.18.0.
22+
23+
### Impact
24+
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
25+
cvss_v4: 9.3
26+
patched_versions:
27+
- "~> 1.10.6"
28+
- "~> 2.1.3"
29+
- ">= 2.2.3"
30+
related:
31+
url:
32+
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
33+
- https://github.com/omniauth/omniauth-saml/commit/0d5eaa0d808acb2ac96deadf5c750ac1cf2d92b5
34+
- https://github.com/omniauth/omniauth-saml/commit/2c8a482801808bbcb0188214bde74680b8018a35
35+
- https://github.com/omniauth/omniauth-saml/commit/7a348b49083462a566af41a5ae85e9f3af15b985
36+
- https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16
37+
- https://rubygems.org/gems/omniauth-saml/versions/2.2.3
38+
- https://github.com/advisories/GHSA-hw46-3hmr-x9xv
39+
---

0 commit comments

Comments
 (0)