Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: Summary:
A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter.
Details:
The loading endpoint accepts and uses an unvalidated "next" parameter for redirects:
PoC:
Visit: /loading?next=https://google.com while authenticated. The page will redirect to google.com.
Impact:
This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites.
References
https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q9rr-h3hx-m87g
https://nvd.nist.gov/vuln/detail/CVE-2024-53264
https://github.com/advisories/GHSA-q9rr-h3hx-m87g
December 3rd, 2024 (5 months ago)
|
|
|
Description: Summary
When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/{namespace}/{name}
When using --auth-mode=sso, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: /api/v1/workflows/{namespace}/{name}
Details
No authentication is performed by the Server itself on client tokens[^1]. Authentication & authorization is instead delegated to the k8s API server.
However, the Workflow Archive does not interact with k8s, and so any token that looks valid will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does the equivalent of a kubectl auth can-i check for respective methods.
In #12736 / v3.5.7 and #13021 / v3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on these lines, allowing archived workflows to be retrieved with a fake token.
PoC
Configuration
Controller ConfigMap:
config: |
persistence:
archive: true
postgresql:
database: argoworkflows
host: db-host
passwordSecret:
key: postgresPassword
name: argo-wf-postgres-credentials
port: 5432
tableName: argo_workflows
userNameSecret:
key: username
name: argo-wf-postgres-credentials
Server: --auth-mode...
December 3rd, 2024 (5 months ago)
|
|
|
Description: Impact
Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
We are currently working on a patch that will be released when ready.
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: #1488
References
https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
https://nvd.nist.gov/vuln/detail/CVE-2024-52800
https://github.com/veraPDF/veraPDF-library/issues/1488
https://github.com/advisories/GHSA-4cx5-89vm-833x
December 3rd, 2024 (5 months ago)
|
|
|
Description: Impact
Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
We are currently working on a patch that will be released when ready.
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: #1488
References
https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
https://nvd.nist.gov/vuln/detail/CVE-2024-52800
https://github.com/veraPDF/veraPDF-library/issues/1488
https://github.com/advisories/GHSA-4cx5-89vm-833x
December 3rd, 2024 (5 months ago)
|
|
|
Description: Impact
Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
We are currently working on a patch that will be released when ready.
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: #1488
References
https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
https://nvd.nist.gov/vuln/detail/CVE-2024-52800
https://github.com/veraPDF/veraPDF-library/issues/1488
https://github.com/advisories/GHSA-4cx5-89vm-833x
December 3rd, 2024 (5 months ago)
|
|
|
Description: Impact
Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
We are currently working on a patch that will be released when ready.
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: #1488
References
https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
https://nvd.nist.gov/vuln/detail/CVE-2024-52800
https://github.com/veraPDF/veraPDF-library/issues/1488
https://github.com/advisories/GHSA-4cx5-89vm-833x
December 3rd, 2024 (5 months ago)
|
|
|
Description: Impact
Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
We are currently working on a patch that will be released when ready.
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: #1488
References
https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
https://nvd.nist.gov/vuln/detail/CVE-2024-52800
https://github.com/veraPDF/veraPDF-library/issues/1488
https://github.com/advisories/GHSA-4cx5-89vm-833x
December 3rd, 2024 (5 months ago)
|
|
|
Description: Impact
Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
We are currently working on a patch that will be released when ready.
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: #1488
References
https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x
https://nvd.nist.gov/vuln/detail/CVE-2024-52800
https://github.com/veraPDF/veraPDF-library/issues/1488
https://github.com/advisories/GHSA-4cx5-89vm-833x
December 3rd, 2024 (5 months ago)
|
|
|
Description: Summary
Note: i'm reporting this in this way purely because it's private and i don't want to broadcast vulnerabilities.
An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
Details
https://github.com/redis/lettuce/blob/main/pom.xml#L67C9-L67C53 The netty version pinned here is currently
4.1.113.Final
This version is vulnerable according to Snyk and is affecting one of our products:
Here is a link to the CVE
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Not applicable
Impact
What kind of vulnerability is it? Who is impacted?
Denial of Service, affecting Windows users.
References
https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv
https://github.com/redis/lettuce/security/advisories/GHSA-q4h9-7rxj-7gx2
https://nvd.nist.gov/vuln/detail/CVE-2024-47535
https://github.com/advisories/GHSA-q4h9-7rxj-7gx2
December 3rd, 2024 (5 months ago)
|
|
|
Description: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.
References
https://nvd.nist.gov/vuln/detail/CVE-2024-38827
https://spring.io/security/cve-2024-38827
https://github.com/spring-projects/spring-framework/issues/33708
https://github.com/spring-projects/spring-framework/commit/11d4272ff48b4a4dabc4b28dfbff0364a4204bc9
https://github.com/advisories/GHSA-q3v6-hm2v-pw99
December 3rd, 2024 (5 months ago)
|