Pwntester

RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning, which could have led to a full repository takeover. The workflow gets triggered when the `PR - Docker build test` workflow completes successfully and downloads an artifact uploaded by the triggering workflow. However, prior to commit 64e00e7, it did not validate the contents of the artifact, allowing a malicious actor to send a Pull Request that uploads a malicious `package.json` file with a script to run arbitrary code in the context of the privileged workflow. The `docker-test-cont.yml` workflow collects information about the Pull Request and sets labels depending on the PR body and sender. If the PR contains a `routes` markdown block, it sets the `TEST CONTINUE` environment variable to `true`.

Name of the Vulnerable Software and Affected Versions: arduino-esp32 (affected versions not specified) Description: The issue concerns multiple Poisoned Pipeline Execution (PPE) vulnerabilities in the arduino-esp32 CI, including code injection in the `tests results.yml` workflow and environment variable injection. These vulnerabilities have the potential for repository takeover and enable remote attacks with high impact. Users are advised to verify the contents of the downloaded artifacts. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The `/api/v2/simulation` POST handler in Hoverfly allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary files from the Hoverfly server. Although the code prevents absolute paths from being specified, an attacker can escape out of the `hf.Cfg.ResponsesBodyFilesPath` base path by using `../` segments and reach any arbitrary files. This issue may lead to Information Disclosure.

The issue arises from the user-controlled `role` parameter entering the application in the Kubernetes::RoleVerificationsController. This parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse file method, where it is unsafely deserialized using the YAML.load stream method. This may lead to Remote Code Execution (RCE).

The issue is related to Environment Variable injection in Litestar's `docs-preview.yml` workflow, which may lead to secret exfiltration and repository manipulation. This grants a malicious actor permission to write issues, read metadata, and write pull requests. The `DOCS PREVIEW DEPLOY TOKEN` is also exposed to the attacker. The vulnerability allows an attacker to send a malicious `.pr number` file, which can define new Environment Variables, including `LD PRELOAD`, to force the system to load a malicious shared library. This can result in arbitrary code execution when the `node` command is run.

The JupyterLab extension template has a remote code execution (RCE) vulnerability in the `update-integration-tests.yml` workflow. This issue affects repositories created using the template with the `test` option. Extension authors are advised to upgrade the template to the latest version. Users who have modified the `update-integration-tests.yml` file should accept overwriting of this file and reapply their changes later. It is recommended to temporarily disable GitHub Actions while working on the upgrade and to rebase all open pull requests from untrusted users.

The issue is related to incorrect code generation management in OpenMetadata, which can be exploited to execute arbitrary code remotely. An attacker can send a PUT request to "/api/v1/policies" to reach the vulnerable method. The `CompiledRule::validateExpression` function is called from `PolicyRepository.prepare`, and `prepare()` is called from `EntityRepository.prepareInternal()`, which in turn gets called from `EntityResource.createOrUpdate()`. Although there is an authorization check, it is called after the SpEL expression has been evaluated, allowing potential exploitation. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1.

The issue is related to the authentication mechanism in OpenMetadata, specifically with the `JwtFilter` that handles API authentication by verifying JWT tokens. An attacker can bypass the authentication mechanism by manipulating path parameters to make any path contain arbitrary strings, allowing access to arbitrary endpoints without JWT validation. This can lead to authentication bypass and potentially to arbitrary SpEL expression injection. The estimated number of potentially affected devices is not specified.

The issue is related to the `CompiledRule::validateExpression` method, which evaluates an SpEL expression using a `StandardEvaluationContext`. This allows the expression to interact with Java classes, such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/policies/validation/condition/<expression>` endpoint passes user-controlled data to `CompiledRule::validateExpression`, enabling authenticated non-admin users to execute arbitrary system commands on the underlying operating system. A missing authorization check, as `Authorizer.authorize()` is never called in the affected path, allows any authenticated non-admin user to trigger this endpoint and evaluate arbitrary SpEL expressions, leading to arbitrary command execution.

The issue is related to the `AlertUtil::validateExpression` method, which can lead to Remote Code Execution. An attacker can send a PUT request to "/api/v1/events/subscriptions" to exploit this vulnerability. The `prepare()` method is called from `EntityRepository.prepareInternal()`, which in turn gets called from `EntityResource.createOrUpdate()`. Although there is an authorization check, it gets called after the SpEL expression has been evaluated. This vulnerability may lead to Remote Code Execution and has been addressed in version 1.2.4.

The issue is related to the `AlertUtil::validateExpression` method, which evaluates an SpEL expression using `getValue` with the `StandardEvaluationContext`, allowing interaction with Java classes such as `java.lang.Runtime` and leading to Remote Code Execution. The `/api/v1/events/subscriptions/validation/condition/<expression>` endpoint passes user-controlled data to `AlertUtil::validateExpression`, enabling authenticated non-admin users to execute arbitrary system commands on the underlying operating system due to a missing authorization check. This may lead to Remote Code Execution.

The issue concerns a Poisoned Pipeline Execution through Code Injection in the ci-failure-comment.yml GitHub Workflow of Monkeytype. This vulnerability allows attackers to gain pull-requests write access by exploiting the lack of validation in the `steps.pr num reader.outputs.content` WorkFlow variable, which is later interpolated into a JS script. This enables an attacker to change the code to be executed.

The issue concerns a partial Server-Side Request Forgery vulnerability in the `hassio.addon stdin` service, where an attacker capable of calling this service may be able to invoke any Supervisor REST API endpoints with a POST request. This could allow the attacker to control the data dictionary, including its addon and input key/values.

The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can result in full compromise and remote code execution (RCE) when combined with other security advisories.

The issue allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. This is possible because the plugin trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs.

A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job. This issue is due to an incomplete fix and results from not requiring POST requests for an HTTP endpoint. The vulnerability enables attackers to exploit the `HTTP endpoint` and capture sensitive information.

The issue is related to insufficient protection of registration data, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This is due to the plugin not setting the appropriate context for credentials lookup. Attackers can exploit this to gain unauthorized access to protected information.

A cross-site request forgery (CSRF) vulnerability allows attackers to trick users into logging in to the attacker's account. This issue arises because the plugin does not implement a state parameter in its OAuth flow, which is a unique and non-guessable value associated with each authentication request.

A missing permission check in the Jenkins mabl Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. The plugin does not perform permission checks in several HTTP endpoints, which also results in a cross-site request forgery (CSRF) vulnerability due to not requiring POST requests.

A missing permission check in the Jenkins Datadog Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. The issue is related to an HTTP endpoint that does not perform a permission check, enabling attackers to exploit this vulnerability.