Security
Headlines
HeadlinesLatestCVEs

Tag

#git

GHSA-h356-3mfw-x368: Mattermost Fails to Verify User's Permissions When Accessing Groups

Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request.

ghsa
#git#perl
GHSA-fpff-wj6m-grvr: Mattermost Fails to Check User Access to `ExperimentalSettings`

Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.

Xoxo to Prague

In this week’s newsletter, Thor inspects the LockBit leak, finding $10,000 “security tips,” ransom negotiations gone wrong and a rare glimpse into the human side of cybercrime.

Coinbase Customer Info Stolen by Bribed Overseas Agents

Coinbase insider breach: Bribed overseas agents stole user data; company rejects ransom, offers $20M reward, boosts security, and…

GHSA-m32f-fjw2-37v3: Bullfrog's DNS over TCP bypasses domain filtering

### Summary Using tcp breaks blocking and allows DNS exfiltration. ### PoC ``` name: test on: push: branches: - "*" jobs: testBullFrog: runs-on: ubuntu-22.04 steps: - name: Use google dns run: | sudo resolvectl dns eth0 1.1.1.1 resolvectl status - name: Set up bullfrog to block everything uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2 with: egress-policy: block allowed-domains: | *.github.com - name: Test connectivity run: | echo testing udp allowed .. dig api.github.com @1.1.1.1 || : echo testing tcp allowed .. dig api.github.com @1.1.1.1 +tcp || : echo testing udp not allowed dig api.google.com @1.1.1.1 || : echo testing tcp not allowed dig api.google.com @1.1.1.1 +tcp || : ``` ### Impact sandbox bypass ![image](https://github.com/user-attach...

GHSA-rf8x-9mhr-49wg: Reflex vulnerable to private state fields modification

### Summary A user on the website can modify any private field on their own state. ### Details An event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields. ### Impact If one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.

GHSA-g5mq-prx7-c588: motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

### Summary Using a constructed (camera) device path with the `config/add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any UNIX shell code within a non-interactive shell as executing user of the motionEye instance, `motion` by default. #### function call stack 1. `post` 2. `add_camera` 3. `config.add_camera` 4. `v4l2ctl.list_resolutions` 5. `utils.call_subprocess` 6. `subprocess.run` ### PoC #### build ```sh RUN_USER="user" RUN_UID=$(id -u ${RUN_USER}) RUN_GID=$(id -g ${RUN_USER}) TIMESTAMP="$(date '+%Y%m%d-%H%M')" docker build \ --network host \ --build-arg="RUN_UID=${RUN_UID?}" \ --build-arg="RUN_GID=${RUN_GID?}" \ -t "${USER?}/motioneye:${TIMESTAMP}" \ --no-cache \ -f docker/Dockerfile . ``` #### reproduce Run: ```sh docker run --rm -d -p 8765:8765 --hostname="motioneye" -v /etc/localtime:/etc/localtime:ro -v /tmp/motioneyeconfig:/etc/motioneye -v /tmp/motioneyeconfig:/var/lib/motioneye ``` ```console ...

GHSA-f6rx-hf55-4255: Sulu vulnerable to XXE in SVG File upload Inspector

### Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. ### Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are: - 2.6.9 - 2.5.25 - 3.0.0-alpha3 ### Workarounds Patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` in sulu with: ```diff -$dom->loadXML($svg, \LIBXML_NOENT | \LIBXML_DTDLOAD); +$dom->loadXML($data, LIBXML_NONET); ``` ### References - GitHub repository: https://github.com/sulu/sulu - Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php

GHSA-cxrh-j4jr-qwg3: undici Denial of Service attack via bad certificate data

### Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. ### Patches This has been patched in https://github.com/nodejs/undici/pull/4088. ### Workarounds If a webhook fails, avoid keep calling it repeatedly. ### References Reported as: https://github.com/nodejs/undici/issues/3895