GHSA-MM6V-68QP-F9FW

Vulnerability from github – Published: 2025-01-15 22:04 – Updated: 2025-02-13 16:49
VLAI?
Summary
Crayfish allows Remote Code Execution via Homarus Authorization header
Details

Impact

Remote code execution may be possible in web-accessible installations of Homarus in certain configurations.

Patches

The issue has been patched in islandora/crayfish:4.1.0

Workarounds

The exploit requires making a request against the Homarus's /convert endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.

Configure auth in Crayfish to be more strongly required, such that requests with Authorization headers that do not validate are rejected before the problematic CLI interpolation occurs.

References

  • XBOW-024-071
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "islandora/crayfish"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-25286"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150",
      "CWE-157"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-15T22:04:19Z",
    "nvd_published_at": "2025-02-13T01:15:25Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n\nThe exploit requires making a request against the Homarus\u0027s `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n\n- XBOW-024-071",
  "id": "GHSA-mm6v-68qp-f9fw",
  "modified": "2025-02-13T16:49:25Z",
  "published": "2025-01-15T22:04:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Islandora/Crayfish/security/advisories/GHSA-mm6v-68qp-f9fw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25286"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Islandora/Crayfish/commit/64cb4cec688928798cc40e6f0a0e863d7f69fd89"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Islandora/Crayfish"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Crayfish allows Remote Code Execution via Homarus Authorization header"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.