CVE-2024-36115

{"id": "CVE-2024-36115", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-06-19T18:15:10.597", "references": [{"url": "https://github.com/dzikoysk/reposilite/commit/279a472015ec675c1da449d902dc82e4dd578484", "source": "security-advisories@github.com"}, {"url": "https://github.com/dzikoysk/reposilite/commit/d11609f427aba255e0f6f54b1105d5d20ab043cf", "source": "security-advisories@github.com"}, {"url": "https://github.com/dzikoysk/reposilite/releases/tag/3.5.12", "source": "security-advisories@github.com"}, {"url": "https://github.com/dzikoysk/reposilite/security/advisories/GHSA-9w8w-34vr-65j2", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML content with javascript inside, the javascript is executed within the same origin. Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the browser's local storage where the user's password (aka 'token-secret') is stored. It is especially dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such malicious packages can be used to attack the Reposilite instance. This issue may lead to the full Reposilite instance compromise. If this attack is performed against the admin user, it's possible to use the admin API to modify settings and artifacts on the instance. In the worst case scenario, an attacker would be able to obtain the Remote code execution on all systems that use artifacts from Reposilite. It's important to note that the attacker does not need to lure a victim user to use a malicious artifact, but just open a link in the browser. This link can be silently loaded among the other HTML content, making this attack unnoticeable. Even if the Reposilite instance is located in an isolated environment, such as behind a VPN or in the local network, this attack is still possible as it can be performed from the admin browser. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-072."}, {"lang": "es", "value": "Reposilite es un administrador de repositorio de c\u00f3digo abierto, liviano y f\u00e1cil de usar para artefactos basados en Maven en el ecosistema JVM. Como administrador de repositorio de Maven, Reposilite brinda la capacidad de ver el contenido de los artefactos en el navegador, as\u00ed como realizar tareas administrativas a trav\u00e9s de API. El problema radica en el hecho de que el contenido del artefacto se entrega a trav\u00e9s del mismo origen (protocolo/host/puerto) que la interfaz de usuario del administrador. Si el artefacto contiene contenido HTML con javascript dentro, el javascript se ejecuta dentro del mismo origen. Por lo tanto, si un usuario autenticado est\u00e1 viendo el contenido de los artefactos, el javascript interno puede acceder al almacenamiento local del navegador donde se almacena la contrase\u00f1a del usuario (tambi\u00e9n conocida como 'token-secret'). Es especialmente peligroso en escenarios donde Reposilite est\u00e1 configurado para reflejar repositorios de terceros, como el Repositorio Central de Maven. Dado que cualquiera puede publicar un artefacto en Maven Central con su propio nombre, dichos paquetes maliciosos se pueden utilizar para atacar la instancia de Reposilite. Este problema puede provocar que la instancia de Reposilite se vea comprometida por completo. Si este ataque se realiza contra el usuario administrador, es posible utilizar la API de administrador para modificar la configuraci\u00f3n y los artefactos en la instancia. En el peor de los casos, un atacante podr\u00eda obtener la ejecuci\u00f3n remota de c\u00f3digo en todos los sistemas que utilicen artefactos de Reposilite. Es importante tener en cuenta que el atacante no necesita atraer al usuario v\u00edctima para que utilice un artefacto malicioso, sino simplemente abrir un enlace en el navegador. Este enlace se puede cargar silenciosamente entre el resto del contenido HTML, lo que hace que este ataque pase desapercibido. Incluso si la instancia de Reposilite est\u00e1 ubicada en un entorno aislado, como detr\u00e1s de una VPN o en la red local, este ataque a\u00fan es posible ya que se puede realizar desde el navegador de administraci\u00f3n. Reposilite ha solucionado este problema en la versi\u00f3n 3.5.12. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad. Este problema fue descubierto e informado por el laboratorio de seguridad de GitHub y tambi\u00e9n se rastrea como GHSL-2024-072."}], "lastModified": "2024-06-20T12:43:25.663", "sourceIdentifier": "security-advisories@github.com"}