GHSA-9JXW-CFRH-JXQ6

Vulnerability from github – Published: 2021-08-30 16:11 – Updated: 2022-08-11 00:16
VLAI?
Summary
Cachet vulnerable to new line injection during configuration edition
Details

Impact

Authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server.

Patches

This issue was addressed by improving UpdateConfigCommandHandler and preventing the use of new lines characters in new configuration values.

Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

References

  • https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection

For more information

If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an email to vulnerability.research [at] sonarsource.com; - The maintainers, by opening an issue on this repository.

Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "cachethq/cachet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-27T23:35:16Z",
    "nvd_published_at": "2021-08-27T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAuthenticated users, regardless of their privileges (_User_ or _Admin_), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server.\n\n### Patches\n\nThis issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values.\n\n### Workarounds\n\nOnly allow trusted source IP addresses to access to the administration dashboard.\n\n### References\n\n- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection\n\n### For more information\n\nIf you have any questions or comments about this advisory, you can contact:\n- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;\n- The maintainers, by opening an issue on this repository.\n",
  "id": "GHSA-9jxw-cfrh-jxq6",
  "modified": "2022-08-11T00:16:20Z",
  "published": "2021-08-30T16:11:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fiveai/Cachet/security/advisories/GHSA-9jxw-cfrh-jxq6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39172"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fiveai/Cachet/commit/6442976c25930cb370c65a22784b9caee7ed1de2"
    },
    {
      "type": "WEB",
      "url": "https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fiveai/Cachet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fiveai/Cachet/releases/tag/v2.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cachet vulnerable to new line injection during configuration edition"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.