From 01d45130adf6243e5e18ce00050536ea2896865e Mon Sep 17 00:00:00 2001
From: ag <ag@wiseadvice.eu>
Date: Wed, 6 Mar 2024 08:42:19 +0100
Subject: [PATCH] commit by to_remotes 2024-03-06 08:42:19 +0100 from vmdevac

---
 bundle-audit-time.txt |  2 +-
 bundle-audit.json     |  2 +-
 report.txt            | 11 ++++++++++-
 update-info.txt       |  9 ++++++---
 4 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/bundle-audit-time.txt b/bundle-audit-time.txt
index e31a6ce..dc9704c 100644
--- a/bundle-audit-time.txt
+++ b/bundle-audit-time.txt
@@ -1 +1 @@
-2024-03-05T14:51:16+01:00
+2024-03-06T08:42:18+01:00
diff --git a/bundle-audit.json b/bundle-audit.json
index 77502e7..4594c13 100644
--- a/bundle-audit.json
+++ b/bundle-audit.json
@@ -1 +1 @@
-{"version":"0.9.1","created_at":"2024-03-05 14:51:15 +0100","results":[]}
\ No newline at end of file
+{"version":"0.9.1","created_at":"2024-03-06 08:42:17 +0100","results":[{"type":"unpatched_gem","gem":{"name":"yard","version":"0.9.35"},"advisory":{"path":"/home/wiseadvice/.local/share/ruby-advisory-db/gems/yard/CVE-2024-27285.yml","id":"CVE-2024-27285","url":"https://github.com/advisories/GHSA-8mq4-9jjh-9xrc","title":"YARD's default template vulnerable to Cross-site Scripting in generated frames.html","date":"2024-02-28","description":"\n### Summary\n\nThe \"frames.html\" file within the Yard Doc's generated documentation\nis vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate\nsanitization of user input within the JavaScript segment of the\n\"frames.erb\" template file.\n\n### Details\n\nThe vulnerability stems from mishandling user-controlled data retrieved\nfrom the URL hash in the embedded JavaScript code within the \"frames.erb\"\ntemplate file. Specifically, the script lacks proper sanitization of\nthe hash data before utilizing it to establish the top-level window's\nlocation. This oversight permits an attacker to inject malicious\nJavaScript payloads through carefully crafted URLs.\n\nSnippet from \"frames.erb\":\n(v0.9.34)\n```erb\n<script type=\"text/javascript\">\n  var match = unescape(window.location.hash).match(/^#!(.+)/);\n  var name = match ? match[1] : '<%= url_for_main %>';\n  name = name.replace(/^(\\w+):\\/\\//, '').replace(/^\\/\\//, '');\n  window.top.location = name;\n</script>\n```\n\n(v0.9.35)\n```erb\n<script type=\"text/javascript\">\n  var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);\n  var name = match ? match[1] : '<%= url_for_main %>';\n  name = name.replace(/^((\\w*):)?[\\/\\\\]*/gm, '').trim();\n  window.top.location.replace(name)\n</script>\n```\n\n### PoC (Proof of Concept)\n\nTo exploit this vulnerability:\n1. Gain access to the generated Yard Doc.\n2. Locate and access the \"frames.html\" file.\n3. Construct a URL containing the malicious payload in the hash\n   segment, for instance: `#!javascript:xss` for v0.9.34, and\n   `#:javascript:xss` for v0.9.35\n\n### Impact\n\nThis XSS vulnerability presents a substantial threat by enabling\nan attacker to execute arbitrary JavaScript code within the user's\nsession context. Potential ramifications include session hijacking,\ntheft of sensitive data, unauthorized access to user accounts, and\ndefacement of websites. Any user visiting the compromised page is\nsusceptible to exploitation. It is critical to promptly address\nthis vulnerability to mitigate potential harm to users and preserve\nthe application's integrity.\n","cvss_v2":null,"cvss_v3":5.4,"cve":"2024-27285","osvdb":null,"ghsa":"8mq4-9jjh-9xrc","unaffected_versions":[],"patched_versions":[">= 0.9.36"],"criticality":"medium"}}]}
\ No newline at end of file
diff --git a/report.txt b/report.txt
index 8900c02..9472352 100644
--- a/report.txt
+++ b/report.txt
@@ -1 +1,10 @@
-No vulnerabilities found
+Name: yard
+Version: 0.9.35
+CVE: CVE-2024-27285
+GHSA: GHSA-8mq4-9jjh-9xrc
+Criticality: Medium
+URL: https://github.com/advisories/GHSA-8mq4-9jjh-9xrc
+Title: YARD's default template vulnerable to Cross-site Scripting in generated frames.html
+Solution: upgrade to '>= 0.9.36'
+
+Vulnerabilities found!
diff --git a/update-info.txt b/update-info.txt
index 770f915..9146ca4 100644
--- a/update-info.txt
+++ b/update-info.txt
@@ -1,7 +1,10 @@
 Updating ruby-advisory-db ...
-Already up to date.
+Updating d7edb7c..2626a46
+Fast-forward
+ gems/yard/CVE-2024-27285.yml | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
 Updated ruby-advisory-db
 ruby-advisory-db:
   advisories:	877 advisories
-  last updated:	2024-03-04 14:42:13 -0800
-  commit:	d7edb7c40894247c00553e35f94e428ddf0c9dd9
+  last updated:	2024-03-05 11:20:20 -0800
+  commit:	2626a46a23e5cfb2e6d636abfcd8cdc0c9f6c520