diff --git a/bundle-audit-time.txt b/bundle-audit-time.txt index da8f834..732dbfc 100644 --- a/bundle-audit-time.txt +++ b/bundle-audit-time.txt @@ -1 +1 @@ -2024-02-29T07:25:04+01:00 +2024-02-29T07:26:25+01:00 diff --git a/bundle-audit.json b/bundle-audit.json index 4574bb0..a885cea 100644 --- a/bundle-audit.json +++ b/bundle-audit.json @@ -1 +1 @@ -{"version":"0.9.1","created_at":"2024-02-29 07:25:04 +0100","results":[{"type":"unpatched_gem","gem":{"name":"yard","version":"0.9.28"},"advisory":{"path":"/home/wiseadvice/.local/share/ruby-advisory-db/gems/yard/CVE-2024-27285.yml","id":"CVE-2024-27285","url":"https://github.com/advisories/GHSA-8mq4-9jjh-9xrc","title":"YARD's default template vulnerable to Cross-site Scripting in generated frames.html","date":"2024-02-28","description":"\n### Summary\n\nThe \"frames.html\" file within the Yard Doc's generated documentation\nis vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate\nsanitization of user input within the JavaScript segment of the\n\"frames.erb\" template file.\n\n### Details\n\nThe vulnerability stems from mishandling user-controlled data retrieved\nfrom the URL hash in the embedded JavaScript code within the \"frames.erb\"\ntemplate file. Specifically, the script lacks proper sanitization of\nthe hash data before utilizing it to establish the top-level window's\nlocation. This oversight permits an attacker to inject malicious\nJavaScript payloads through carefully crafted URLs.\n\nSnippet from \"frames.erb\":\n```erb\n\n```\n\n### PoC (Proof of Concept)\n\nTo exploit this vulnerability:\n1. Gain access to the generated Yard Doc.\n2. Locate and access the \"frames.html\" file.\n3. Construct a URL containing the malicious payload in the hash\n segment, for instance: `#!javascript:xss`\n\n### Impact\n\nThis XSS vulnerability presents a substantial threat by enabling\nan attacker to execute arbitrary JavaScript code within the user's\nsession context. Potential ramifications include session hijacking,\ntheft of sensitive data, unauthorized access to user accounts, and\ndefacement of websites. Any user visiting the compromised page is\nsusceptible to exploitation. It is critical to promptly address\nthis vulnerability to mitigate potential harm to users and preserve\nthe application's integrity.\n","cvss_v2":null,"cvss_v3":5.4,"cve":"2024-27285","osvdb":null,"ghsa":"8mq4-9jjh-9xrc","unaffected_versions":[],"patched_versions":[">= 0.9.35"],"criticality":"medium"}}]} \ No newline at end of file +{"version":"0.9.1","created_at":"2024-02-29 07:26:25 +0100","results":[]} \ No newline at end of file diff --git a/report.txt b/report.txt index f81e33d..8900c02 100644 --- a/report.txt +++ b/report.txt @@ -1,10 +1 @@ -Name: yard -Version: 0.9.28 -CVE: CVE-2024-27285 -GHSA: GHSA-8mq4-9jjh-9xrc -Criticality: Medium -URL: https://github.com/advisories/GHSA-8mq4-9jjh-9xrc -Title: YARD's default template vulnerable to Cross-site Scripting in generated frames.html -Solution: upgrade to '>= 0.9.35' - -Vulnerabilities found! +No vulnerabilities found diff --git a/update-info.txt b/update-info.txt index d26dee1..541f6fe 100644 --- a/update-info.txt +++ b/update-info.txt @@ -1,12 +1,5 @@ Updating ruby-advisory-db ... -Updating 1c7d5b5..06f3374 -Fast-forward - gems/rack/CVE-2024-25126.yml | 1 + - gems/rack/CVE-2024-26141.yml | 1 + - gems/rack/CVE-2024-26146.yml | 1 + - gems/yard/CVE-2024-27285.yml | 64 ++++++++++++++++++++++++++++++++++++++++++++ - 4 files changed, 67 insertions(+) - create mode 100644 gems/yard/CVE-2024-27285.yml +Already up to date. Updated ruby-advisory-db ruby-advisory-db: advisories: 876 advisories