github - ghsa-5fw3-pvfm-qmmq

GHSA-5FW3-PVFM-QMMQ

Vulnerability from github – Published: 2024-12-05 12:31 – Updated: 2024-12-05 15:31

Details

User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened. This issue affects DropBox Sign(HelloSign): through 2024-12-04.

Severity ?

8.2 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/U:Red

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-52270"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-451"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-05T11:15:06Z",
    "severity": "HIGH"
  },
  "details": "User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.\nDisplayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DropBox Sign(HelloSign): through 2024-12-04.",
  "id": "GHSA-5fw3-pvfm-qmmq",
  "modified": "2024-12-05T15:31:01Z",
  "published": "2024-12-05T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52270"
    },
    {
      "type": "WEB",
      "url": "https://app.hellosign.com"
    },
    {
      "type": "WEB",
      "url": "https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj"
    },
    {
      "type": "WEB",
      "url": "https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs"
    },
    {
      "type": "WEB",
      "url": "https://sign.dropbox.com"
    },
    {
      "type": "WEB",
      "url": "https://www.loom.com/share/48f63594e14c49e19840ad9cb7d60453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038"
    },
    {
      "type": "WEB",
      "url": "https://www.vulsec.org/advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2024-52270 (GCVE-0-2024-52270)

Vulnerability from cvelistv5 – Published: 2024-12-05 10:55 – Updated: 2024-12-05 16:52

Summary

Severity ?

8.2 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/AU:Y/U:Red

CWE

CWE-451 - User Interface (UI) Misrepresentation of Critical Information

Assigner

VULSec

References

URL

Tags

	https://www.vulsec.org/advisories	vdb-entry
	https://www.loom.com/share/48f63594e14c49e19840ad…	exploit
	https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_…	exploit
	https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj	exploit
	https://sign.dropbox.com/	product
	https://app.hellosign.com/	product

Impacted products

	Vendor	Product	Version
	DropBox(HelloSign)	DropBox Sign	Affected: 0 , ≤ 2024-12-04 (git)

Credits

Erez Kalman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52270",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T14:49:19.543227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-05T14:53:37.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "DropBox Sign",
          "vendor": "DropBox(HelloSign)",
          "versions": [
            {
              "lessThanOrEqual": "2024-12-04",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erez Kalman"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.\u003cbr\u003eDisplayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -\u0026gt; Examine the print preview): Will render the vulnerability only, not all layers are flattened.\u003cbr\u003e\u003cp\u003eThis issue affects DropBox Sign(HelloSign): through 2024-12-04.\u003c/p\u003e"
            }
          ],
          "value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.\nDisplayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\nThis issue affects DropBox Sign(HelloSign): through 2024-12-04."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Known, potentially in use (e.g., spear phishing)"
            }
          ],
          "value": "Known, potentially in use (e.g., spear phishing)"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-148",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-148 Content Spoofing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "RED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/AU:Y/U:Red",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "id": "CVE-2024-52270",
              "options": [
                {
                  "Exploitation": "active"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Coordinator",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        },
        {
          "other": {
            "content": {
              "Automatable": "Yes",
              "Exploitation": "Active",
              "Technical Impact": "Partial",
              "Value Density": "Diffused",
              "version": "2.0"
            },
            "type": "SSVCv2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-451",
              "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T16:52:35.673Z",
        "orgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
        "shortName": "VULSec"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://www.vulsec.org/advisories"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.loom.com/share/48f63594e14c49e19840ad9cb7d60453?sid=816c6afa-0b67-4b0b-98ff-d5c58d464038"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://new.space/s/ZuHoujvkjdzfY7Uihah7Yg#SKWLU_g2Cihfj4qsq9XNy6F4saxVAzD876PujiDOYfs"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://drive.proton.me/urls/Z6DHXNRZQC#jkfO38rjOiOj"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://sign.dropbox.com/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://app.hellosign.com/"
        }
      ],
      "source": {
        "discovery": "USER"
      },
      "tags": [
        "x_known-exploited-vulnerability",
        "exclusively-hosted-service"
      ],
      "title": "PDF Document Spoofing in DropBox Sign(HelloSign)",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "* If other party initiated e-signing - Download the PDF file for a security professionals/educated persons inspection\u003cbr\u003e*  If possible - Download the PDF file and perform full flattening (of the entire document, not just form fields)"
            }
          ],
          "value": "* If other party initiated e-signing - Download the PDF file for a security professionals/educated persons inspection\n*  If possible - Download the PDF file and perform full flattening (of the entire document, not just form fields)"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
    "assignerShortName": "VULSec",
    "cveId": "CVE-2024-52270",
    "datePublished": "2024-12-05T10:55:30.071Z",
    "dateReserved": "2024-11-06T08:35:09.852Z",
    "dateUpdated": "2024-12-05T16:52:35.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-5FW3-PVFM-QMMQ

CVE-2024-52270 (GCVE-0-2024-52270)

Tags

Sightings

Nomenclature