github - ghsa-88f9-7xxh-c688

ghsa-88f9-7xxh-c688

Vulnerability from github

Published

2021-08-30 16:11

Modified

2022-08-16 18:38

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Cachet configuration leak

Details

Impact

Authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (APP_KEY) and various passwords (email, database, etc).

Patches

This issue was addressed by improving UpdateConfigCommandHandler and preventing the use of nested variables in the resulting dotenv configuration file.

Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

References

Further technical details are available at https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection.

For more information

If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an email to vulnerability.research [at] sonarsource.com; - The maintainers, by opening an issue on this repository.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.5.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "cachethq/cachet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39174"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-75"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-27T23:34:07Z",
    "nvd_published_at": "2021-08-28T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAuthenticated users, regardless of their privileges (_User_ or _Admin_), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). \n\n### Patches\n\nThis issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file.\n\n### Workarounds\n\nOnly allow trusted source IP addresses to access to the administration dashboard.\n\n### References\n\nFurther technical details are available at [https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection](https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection).\n\n### For more information\n\nIf you have any questions or comments about this advisory, you can contact:\n- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;\n- The maintainers, by opening an issue on this repository.\n",
  "id": "GHSA-88f9-7xxh-c688",
  "modified": "2022-08-16T18:38:53Z",
  "published": "2021-08-30T16:11:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39174"
    },
    {
      "type": "WEB",
      "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cachethq/Cachet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cachet configuration leak"
}

cve-2021-39174

Vulnerability from cvelistv5

Published

2021-08-27 23:25

Modified

2024-08-04 01:58

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Configuration leak

References

▼	URL	Tags
	https://github.com/fiveai/Cachet/releases/tag/v2.5.1	x_refsource_MISC
	https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688	x_refsource_CONFIRM
	https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/	x_refsource_MISC

Impacted products

▼	Vendor	Product
	fiveai	Cachet

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:58:18.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cachet",
          "vendor": "fiveai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-75",
              "description": "CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-02T15:13:11",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"
        }
      ],
      "source": {
        "advisory": "GHSA-88f9-7xxh-c688",
        "discovery": "UNKNOWN"
      },
      "title": "Configuration leak",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-39174",
          "STATE": "PUBLIC",
          "TITLE": "Configuration leak"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cachet",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 2.5.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "fiveai"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1",
              "refsource": "MISC",
              "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"
            },
            {
              "name": "https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688",
              "refsource": "CONFIRM",
              "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-88f9-7xxh-c688"
            },
            {
              "name": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/",
              "refsource": "MISC",
              "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-88f9-7xxh-c688",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-39174",
    "datePublished": "2021-08-27T23:25:08",
    "dateReserved": "2021-08-16T00:00:00",
    "dateUpdated": "2024-08-04T01:58:18.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-88f9-7xxh-c688

Vulnerability from github

Impact

Patches

Workarounds

References

For more information

cve-2021-39174

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature