github - ghsa-5vgj-ggm4-fg62

ghsa-5vgj-ggm4-fg62

Vulnerability from github

Published

2024-06-25 22:23

Modified

2024-07-26 21:36

Severity

7.2 (High) - CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Summary

pdoc embeds link to malicious CDN if math mode is enabled

Details

Impact

Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code.

Users who produce documentation with math mode should update immediately. All other users are unaffected.

Patches

This issue has been fixed in pdoc 14.5.1.

References

https://github.com/mitmproxy/pdoc/pull/703 https://sansec.io/research/polyfill-supply-chain-attack

Timeline

[2024-06-25] https://sansec.io/research/polyfill-supply-chain-attack is published.
[2024-06-25 20:54 UTC] Issue reported to the pdoc project by @adhintz.
[2024-06-25 21:33 UTC] Patched version released.
[2024-06-25 21:37 UTC] Security advisory published.
[2024-06-25 23:49 UTC] CVE-2024-38526 assigned by GitHub.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pdoc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-38526"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-25T22:23:30Z",
    "nvd_published_at": "2024-06-26T00:15:10Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.\n- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.",
  "id": "GHSA-5vgj-ggm4-fg62",
  "modified": "2024-07-26T21:36:47Z",
  "published": "2024-06-25T22:23:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38526"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/pdoc/pull/703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/pdoc/commit/726b8f2e365fe8afeb3604a7c73d19b460395d58"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mitmproxy/pdoc"
    },
    {
      "type": "WEB",
      "url": "https://sansec.io/research/polyfill-supply-chain-attack"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pdoc embeds link to malicious CDN if math mode is enabled"
}

cve-2024-38526

Vulnerability from cvelistv5

Published

2024-06-25 23:53

Modified

2024-08-14 14:25

Severity

7.2 (High) - cvssV3_1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N

Summary

pdoc embeds link to malicious CDN if math mode is enabled

References

URL	Tags
https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62	x_refsource_CONFIRM
https://github.com/mitmproxy/pdoc/pull/703	x_refsource_MISC
https://sansec.io/research/polyfill-supply-chain-attack	x_refsource_MISC
https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526

Impacted products

Vendor	Product
mitmproxy	pdoc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mitmproxy:pdoc:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "pdoc",
            "vendor": "mitmproxy",
            "versions": [
              {
                "lessThan": "14.5.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38526",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T14:23:46.307681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-14T14:25:31.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.740Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"
          },
          {
            "name": "https://github.com/mitmproxy/pdoc/pull/703",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mitmproxy/pdoc/pull/703"
          },
          {
            "name": "https://sansec.io/research/polyfill-supply-chain-attack",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://sansec.io/research/polyfill-supply-chain-attack"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pdoc",
          "vendor": "mitmproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 14.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1395",
              "description": "CWE-1395: Dependency on Vulnerable Third-Party Component",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-25T23:53:54.677Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"
        },
        {
          "name": "https://github.com/mitmproxy/pdoc/pull/703",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mitmproxy/pdoc/pull/703"
        },
        {
          "name": "https://sansec.io/research/polyfill-supply-chain-attack",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://sansec.io/research/polyfill-supply-chain-attack"
        },
        {
          "url": "https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526"
        }
      ],
      "source": {
        "advisory": "GHSA-5vgj-ggm4-fg62",
        "discovery": "UNKNOWN"
      },
      "title": "pdoc embeds link to malicious CDN if math mode is enabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-38526",
    "datePublished": "2024-06-25T23:53:54.677Z",
    "dateReserved": "2024-06-18T16:37:02.728Z",
    "dateUpdated": "2024-08-14T14:25:31.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

ghsa-5vgj-ggm4-fg62

Vulnerability from github

Impact

Patches

References

Timeline

cve-2024-38526

Vulnerability from cvelistv5

Tags