Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-3133: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.8
Published: 2022-09-09T18:15Z
Repository: https://github.com/jgraph/drawio
Language: Unknown
Commit date: 2022-09-08 13:39:31 +0100
Commit message: Merge branch 'dev' of https://github.com/jgraph/drawio into dev
CVE-2022-46163: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The travel-support-program uses the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The `*_start`, `*_end` or `*_cont` search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force (A match is indicated by the returned JSON not being empty). A single bank account number can be extracted with <200 requests, a password hash can be extracted with ~1200 requests, all within a few minutes. The problem has been patched in commit d22916275c51500b4004933ff1b0a69bc807b2b7. In order to work around this issue, you can also cherry pick that patch, however it will not work without the Rails 5.0 migration that was done in #150, which in turn had quite a few pull requests it depended on.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2023-01-10T21:15Z
Repository: https://github.com/openSUSE/travel-support-program
Language: Ruby
Files changed: app/models/application_record.rb, app/models/reimbursement.rb
Commit date: 2022-11-29 20:01:45 +0100
Commit message: Allow specific ransack queries

Diff: diff --git a/app/models/application_record.rb b/app/models/application_record.rb
index 10a4cba..c59658d 100644
--- a/app/models/application_record.rb
+++ b/app/models/application_record.rb
@@ -1,3 +1,11 @@
 class ApplicationRecord < ActiveRecord::Base
   self.abstract_class = true
+
+  def self.ransackable_attributes(_)
+    super & %w[end_date start_date name description event_id state]
+  end
+
+  def self.ransackable_associations(_)
+    []
+  end
 end
diff --git a/app/models/reimbursement.rb b/app/models/reimbursement.rb
index dc48590..cddcb87 100644
--- a/app/models/reimbursement.rb
+++ b/app/models/reimbursement.rb
@@ -237,6 +237,10 @@ class Reimbursement < ApplicationRecord
         return true unless (expense.keys - acceptable_expenses_attrs).empty?
       end
     end
     false
   end
+
+  def self.ransackable_associations(_)
+    %w[request]
+  end
 end

Fixed code: 
  def self.ransackable_attributes(_)
    super & %w[end_date start_date name description event_id state]
  end

  def self.ransackable_associations(_)
    []
  end

  def self.ransackable_associations(_)
    %w[request]
  end
CVE-2016-10700: Permissions, Privileges, and Access Controls (CWE-264)
value: auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 8.8
Published: 2017-11-24T05:29Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: auth_login.php
Commit date: 2016-08-14 14:21:11 -0500
Commit message: fixing bug #2697

web basic for guest accounts

Diff: diff --git a/auth_login.php b/auth_login.php
index 6a63f2a1..1e94426b 100644
--- a/auth_login.php
+++ b/auth_login.php
@@ -89,14 +89,14 @@ if (get_nfilter_request_var('action') == 'login') {
 		$user_auth = true;
 		$realm = 2;
 		/* Locate user in database */
 		$user = db_fetch_row_prepared('SELECT * FROM user_auth WHERE username = ? AND realm = 2', array($username));
 
-		if (!$user && read_config_option('user_template') == '0') {
-			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but a Template User is not defined in Cacti.  Exiting.", false, 'AUTH');
+		if (!$user && read_config_option('user_template') == '0' && read_config_option('guest_user') == '0') {
+			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.  Exiting.", false, 'AUTH');
 			$username = htmlspecialchars($username);
-			auth_display_custom_error_message( __('%s authenticated by Web Server, but a Template User is not defined in Cacti.', $username) );
+			auth_display_custom_error_message( __('%s authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.', $username) );
 			exit;			
 		}
 
 		break;
 	case '3':

Vulnerable code: 		if (!$user && read_config_option('user_template') == '0') {
			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but a Template User is not defined in Cacti.  Exiting.", false, 'AUTH');
			auth_display_custom_error_message( __('%s authenticated by Web Server, but a Template User is not defined in Cacti.', $username) );
Fixed code: 		if (!$user && read_config_option('user_template') == '0' && read_config_option('guest_user') == '0') {
			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.  Exiting.", false, 'AUTH');
			auth_display_custom_error_message( __('%s authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.', $username) );
CVE-2017-12927: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-08-18T02:29Z
Repository: https://github.com/Cacti/cacti
Language: Other
Files changed: docs/CHANGELOG, spikekill.php
Commit date: 2017-08-15 06:13:10 -0500
Commit message: Resolving Issue #907

XSS in spikekill.php

Diff: diff --git a/docs/CHANGELOG b/docs/CHANGELOG
index 8d1a925d6..c5b1aee6c 100644
--- a/docs/CHANGELOG
+++ b/docs/CHANGELOG
@@ -1,10 +1,11 @@
 Cacti CHANGELOG
 
 1.1.18
 -issue#903: Upgrade pace.js to v0.7.8
 -issue#906: Create a separate Realm for Realtime Graphs
+-issue#907: XSS issue in spikekill.php
 
 1.1.17
 -issue#450: List View to Preview shows no results
 -issue#486: Export Device table results to CSV
 -issue#544: Allow Log Rotation to be other than Daily
diff --git a/spikekill.php b/spikekill.php
index 8d4d5c296..a89df0a8d 100644
--- a/spikekill.php
+++ b/spikekill.php
@@ -32,22 +32,23 @@ if (isset_request_var('method')) {
 		case 'float':
 		case 'variance':
 		case 'fill':
 			break;
 		default:
-			echo __("FATAL: Spike Kill method '%s' is Invalid\n", get_nfilter_request_var('method'));
+			echo __("FATAL: Spike Kill method '%s' is Invalid\n", htmlspecialchars(get_nfilter_request_var('method'), ENT_QUOTES, 'UTF-8'));
 			exit(1);
 			break;
 	}
 }
 
 if (is_realm_allowed(1043)) {
 	$local_data_ids = db_fetch_assoc_prepared('SELECT DISTINCT data_template_rrd.local_data_id
 		FROM graph_templates_item
 		LEFT JOIN data_template_rrd
 		ON graph_templates_item.task_item_id=data_template_rrd.id
-		WHERE graph_templates_item.local_graph_id = ?', array(get_filter_request_var('local_graph_id')));
+		WHERE graph_templates_item.local_graph_id = ?',
+		array(get_filter_request_var('local_graph_id')));
 
 	$results = '';
 	if (sizeof($local_data_ids)) {
 		foreach($local_data_ids as $local_data_id) {
 			$data_source_path = get_data_source_path($local_data_id['local_data_id'], true);

Vulnerable code: 			echo __("FATAL: Spike Kill method '%s' is Invalid\n", get_nfilter_request_var('method'));
		WHERE graph_templates_item.local_graph_id = ?', array(get_filter_request_var('local_graph_id')));
Fixed code: -issue#907: XSS issue in spikekill.php
			echo __("FATAL: Spike Kill method '%s' is Invalid\n", htmlspecialchars(get_nfilter_request_var('method'), ENT_QUOTES, 'UTF-8'));
		WHERE graph_templates_item.local_graph_id = ?',
		array(get_filter_request_var('local_graph_id')));
CVE-2017-15194: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-10-11T01:32Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: include/global_session.php
Commit date: 2017-10-07 11:59:17 -0400
Commit message: XSS fix (#1017)

Fix for issue #1010
Diff: diff --git a/include/global_session.php b/include/global_session.php
index f2587384e..5e38729eb 100644
--- a/include/global_session.php
+++ b/include/global_session.php
@@ -82,15 +82,15 @@ if (isset($_SESSION['refresh'])) {
 } ?>
 <script type='text/javascript'>
 	var cactiVersion='<?php print $config['cacti_version'];?>';
 	var theme='<?php print get_selected_theme();?>';
 	var refreshIsLogout=<?php print $refreshIsLogout;?>;
-	var refreshPage='<?php print $myrefresh['page'];?>';
+	var refreshPage='<?php print htmlspecialchars($myrefresh['page']);?>';
 	var refreshMSeconds=<?php print $myrefresh['seconds']*1000;?>;
 	var urlPath='<?php print $config['url_path'];?>';
 	var previousPage='';
-	var requestURI='<?php print $_SERVER['REQUEST_URI'];?>';
+	var requestURI='<?php print htmlspecialchars($_SERVER['REQUEST_URI']);?>';
 	var searchFilter='<?php print __('Enter a search term');?>';
 	var searchRFilter='<?php print __('Enter a regular expression');?>';
 	var noFileSelected='<?php print __('No file selected');?>';
 	var timeGraphView='<?php print __('Time Graph View');?>';
 	var filterSettingsSaved='<?php print __('Filter Settings Saved');?>';

Vulnerable code: 	var refreshPage='<?php print $myrefresh['page'];?>';
	var requestURI='<?php print $_SERVER['REQUEST_URI'];?>';
Fixed code: 	var refreshPage='<?php print htmlspecialchars($myrefresh['page']);?>';
	var requestURI='<?php print htmlspecialchars($_SERVER['REQUEST_URI']);?>';
CVE-2018-20724: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2019-01-16T16:29Z
Repository: https://github.com/Cacti/cacti
Language: Other
Files changed: CHANGELOG, pollers.php
Commit date: 2018-12-15 08:16:10 -0600
Commit message: Resolving Issue #2212

Stored XSS in "Website Hostname" field

Diff: diff --git a/CHANGELOG b/CHANGELOG
index 5593a39d2a..52558e8a52 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,10 +3,11 @@ Cacti CHANGELOG
 -issue#2184: html_host_filter() does not handle host_id consequently
 -issue#2188: SNMP timeout errors are being duplicated
 -issue#2191: i18n_themes is not properly primed in global_arrays.php
 -issue#2202: Can't create more than one graph with add_graphs.php from one template
 -issue#2207: Removing Graph Template does not Remove Data Query Associations
+-issue#2212: Stored XSS in "Website Hostname" field
 -feature: Update phpseclib to version 2.0.12
 
 1.2.0 Beta 4
 -issue#2186: Boost generates invalid SQL during on demand update
 -issue#2182: Graph View missing 'html_graph_template_multiselect()' function
diff --git a/pollers.php b/pollers.php
index 793ddfbf6c..01262f62c2 100644
--- a/pollers.php
+++ b/pollers.php
@@ -847,11 +847,11 @@ function pollers() {
 			}
 
 			form_alternate_row('line' . $poller['id'], true, $disabled);
 			form_selectable_cell(filter_value($poller['name'], get_request_var('filter'), 'pollers.php?action=edit&id=' . $poller['id']), $poller['id']);
 			form_selectable_cell($poller['id'], $poller['id'], '', 'right');
-			form_selectable_cell($poller['hostname'], $poller['id'], '', 'right');
+			form_selectable_cell(html_escape($poller['hostname']), $poller['id'], '', 'right');
 			form_selectable_cell($poller_status[$poller['status']], $poller['id'], '', 'center');
 			form_selectable_cell($poller['processes'] . '/' . $poller['threads'], $poller['id'], '', 'right');
 			form_selectable_cell(number_format_i18n($poller['total_time'], 2), $poller['id'], '', 'right');
 			form_selectable_cell($mma, $poller['id'], '', 'right');
 			form_selectable_cell(number_format_i18n($poller['hosts'], '-1'), $poller['id'], '', 'right');

Vulnerable code: 			form_selectable_cell($poller['hostname'], $poller['id'], '', 'right');
Fixed code: -issue#2212: Stored XSS in "Website Hostname" field
			form_selectable_cell(html_escape($poller['hostname']), $poller['id'], '', 'right');
CVE-2019-17358: Deserialization of Untrusted Data (CWE-502)
value: Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.1
Published: 2019-12-12T14:15Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: lib/functions.php
Commit date: 2019-10-12 14:56:43 -0500
Commit message: Resoving Issue #3026

Unsafe deserialization in of selected objects in Cacti

Diff: diff --git a/lib/functions.php b/lib/functions.php
index d087bcad98..d944238b96 100644
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -3098,19 +3098,26 @@ function sanitize_cdef($cdef) {
  * @arg array $items   - an array of serialized items from a post
  * @returns array      - the sanitized selected items array
  */
 function sanitize_unserialize_selected_items($items) {
 	if ($items != '') {
-		$items = unserialize(stripslashes($items));
-
-		if (is_array($items)) {
-			foreach ($items as $item) {
-				if (is_array($item)) {
-					return false;
-				} elseif (!is_numeric($item) && ($item != '')) {
-					return false;
+		$unstripped = stripslashes($items);
+
+		// validate that sanitized string is correctly formatted
+		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) {
+			$items = unserialize($unstripped);
+
+			if (is_array($items)) {
+				foreach ($items as $item) {
+					if (is_array($item)) {
+						return false;
+					} elseif (!is_numeric($item) && ($item != '')) {
+						return false;
+					}
 				}
+			} else {
+				return false;
 			}
 		} else {
 			return false;
 		}
 	} else {

Vulnerable code: 		$items = unserialize(stripslashes($items));

		if (is_array($items)) {
			foreach ($items as $item) {
				if (is_array($item)) {
					return false;
				} elseif (!is_numeric($item) && ($item != '')) {
					return false;
Fixed code: 		$unstripped = stripslashes($items);

		// validate that sanitized string is correctly formatted
		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) {
			$items = unserialize($unstripped);

			if (is_array($items)) {
				foreach ($items as $item) {
					if (is_array($item)) {
						return false;
					} elseif (!is_numeric($item) && ($item != '')) {
						return false;
					}
			} else {
				return false;
CVE-2019-17358: Out-of-bounds Write (CWE-787)
value: Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.1
Published: 2019-12-12T14:15Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: lib/functions.php
Commit date: 2019-10-12 14:56:43 -0500
Commit message: Resoving Issue #3026

Unsafe deserialization in of selected objects in Cacti

Diff: diff --git a/lib/functions.php b/lib/functions.php
index d087bcad98..d944238b96 100644
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -3098,19 +3098,26 @@ function sanitize_cdef($cdef) {
  * @arg array $items   - an array of serialized items from a post
  * @returns array      - the sanitized selected items array
  */
 function sanitize_unserialize_selected_items($items) {
 	if ($items != '') {
-		$items = unserialize(stripslashes($items));
-
-		if (is_array($items)) {
-			foreach ($items as $item) {
-				if (is_array($item)) {
-					return false;
-				} elseif (!is_numeric($item) && ($item != '')) {
-					return false;
+		$unstripped = stripslashes($items);
+
+		// validate that sanitized string is correctly formatted
+		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) {
+			$items = unserialize($unstripped);
+
+			if (is_array($items)) {
+				foreach ($items as $item) {
+					if (is_array($item)) {
+						return false;
+					} elseif (!is_numeric($item) && ($item != '')) {
+						return false;
+					}
 				}
+			} else {
+				return false;
 			}
 		} else {
 			return false;
 		}
 	} else {

Vulnerable code: 		$items = unserialize(stripslashes($items));

		if (is_array($items)) {
			foreach ($items as $item) {
				if (is_array($item)) {
					return false;
				} elseif (!is_numeric($item) && ($item != '')) {
					return false;
Fixed code: 		$unstripped = stripslashes($items);

		// validate that sanitized string is correctly formatted
		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) {
			$items = unserialize($unstripped);

			if (is_array($items)) {
				foreach ($items as $item) {
					if (is_array($item)) {
						return false;
					} elseif (!is_numeric($item) && ($item != '')) {
						return false;
					}
			} else {
				return false;
CVE-2024-29895: Insufficient Information (NVD-CWE-noinfo)
value: Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:17Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: cmd_realtime.php
Commit date: 2024-03-27 15:56:37 +0000
Commit message: Merge pull request from GHSA-cr28-x256-xf5m


Diff: diff --git a/cmd_realtime.php b/cmd_realtime.php
index bee0e98407..78946e5aeb 100644
--- a/cmd_realtime.php
+++ b/cmd_realtime.php
@@ -38,14 +38,20 @@ if (cacti_count($_SERVER['argv']) < 4) {
 	print "Usage: cmd_realtime.php POLLER_ID GRAPH_ID INTERVAL\n\n";
 
 	exit(-1);
 }
 
-$poller_id = $_SERVER['argv'][1];
+$poller_id = (int)$_SERVER['argv'][1];
 $graph_id  = (int)$_SERVER['argv'][2];
 $interval  = (int)$_SERVER['argv'][3];
 
+if ($poller_id <= 0) {
+	print "Invalid poller_id specified.\n\n";
+
+	exit(-1);
+}
+
 if ($graph_id <= 0) {
 	print "Invalid graph_id specified.\n\n";
 
 	exit(-1);
 }

Vulnerable code: $poller_id = $_SERVER['argv'][1];
Fixed code: $poller_id = (int)$_SERVER['argv'][1];
if ($poller_id <= 0) {
	print "Invalid poller_id specified.\n\n";

	exit(-1);
}
CVE-2024-29895: Insufficient Information (NVD-CWE-noinfo)
value: Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:17Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: cmd_realtime.php
Commit date: 2024-03-29 18:44:12 -0400
Commit message: Revert "Merge pull request from GHSA-cr28-x256-xf5m"

This reverts commit 53e8014d1f082034e0646edc6286cde3800c683d.

Diff: diff --git a/cmd_realtime.php b/cmd_realtime.php
index 78946e5aeb..bee0e98407 100644
--- a/cmd_realtime.php
+++ b/cmd_realtime.php
@@ -38,20 +38,14 @@ if (cacti_count($_SERVER['argv']) < 4) {
 	print "Usage: cmd_realtime.php POLLER_ID GRAPH_ID INTERVAL\n\n";
 
 	exit(-1);
 }
 
-$poller_id = (int)$_SERVER['argv'][1];
+$poller_id = $_SERVER['argv'][1];
 $graph_id  = (int)$_SERVER['argv'][2];
 $interval  = (int)$_SERVER['argv'][3];
 
-if ($poller_id <= 0) {
-	print "Invalid poller_id specified.\n\n";
-
-	exit(-1);
-}
-
 if ($graph_id <= 0) {
 	print "Invalid graph_id specified.\n\n";
 
 	exit(-1);
 }

Vulnerable code: $poller_id = (int)$_SERVER['argv'][1];
if ($poller_id <= 0) {
	print "Invalid poller_id specified.\n\n";

	exit(-1);
}

Fixed code: $poller_id = $_SERVER['argv'][1];
CVE-2024-30268: Insufficient Information (NVD-CWE-noinfo)
value: Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:22Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: settings.php
Commit date: 2024-02-23 12:56:14 +0000
Commit message: Merge pull request from GHSA-9m3v-whmr-pc2q


Diff: diff --git a/settings.php b/settings.php
index a13b02ebc6..703c95cafb 100644
--- a/settings.php
+++ b/settings.php
@@ -27,10 +27,11 @@ include_once('./lib/poller.php');
 
 /* set default action */
 set_default_action();
 
 get_filter_request_var('tab', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
+get_filter_request_var('filter', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
 
 global $disable_log_rotation, $local_db_cnn_id;
 
 switch (get_request_var('action')) {
 	case 'save':
@@ -61,11 +62,11 @@ function display_settings() {
 	validate_settings_filter();
 
 	print '<tr><td>';
 	print '<table class="filterTable">';
 	print '<td>' . __('Search') . '</td>';
-	print '<td><input type="text" size="25" id="filter" value="' . get_request_var('filter') . '"></td>';
+	print '<td><input type="text" size="25" id="filter" value="' . html_escape_request_var('filter') . '"></td>';
 	print '<td><span><input type="button" id="clear" value="' . __esc('Clear') . '"></span></td>';
 	print '</tr></table>';
 	print '</td></tr>';
 
 	html_end_box();

Vulnerable code: 	print '<td><input type="text" size="25" id="filter" value="' . get_request_var('filter') . '"></td>';
Fixed code: get_filter_request_var('filter', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
	print '<td><input type="text" size="25" id="filter" value="' . html_escape_request_var('filter') . '"></td>';
CVE-2024-31443: Insufficient Information (NVD-CWE-noinfo)
value: Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:25Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: lib/html_tree.php
Commit date: 2024-04-07 15:08:10 +0100
Commit message: Merge pull request from GHSA-rqc8-78cm-85j3

Co-authored-by: ishgard <ishgard@njust.edu.cn>
Diff: diff --git a/lib/html_tree.php b/lib/html_tree.php
index eff98b81dd..419523984b 100644
--- a/lib/html_tree.php
+++ b/lib/html_tree.php
@@ -989,26 +989,29 @@ function grow_right_pane_tree($tree_id, $leaf_id, $host_group_data) {
 		$name = db_fetch_cell_prepared('SELECT name
 			FROM graph_templates
 			WHERE id = ?',
 			array($host_group_data_array[1]));
 
+		$name = html_escape($name);
 		$host_group_data_name = '<strong>' . __('Graph Template:'). '</strong> ' . $name;
 		$graph_template_id    = $host_group_data_array[1];
 	} elseif ($host_group_data_array[0] == 'dq') {
 		$name = db_fetch_cell_prepared('SELECT name
 			FROM snmp_query
 			WHERE id = ?',
 			array($host_group_data_array[1]));
 
+		$name = html_escape($name);
 		$host_group_data_name = '<strong>' . __('Graph Template:') . '</strong> ' . (empty($host_group_data_array[1]) ? __('Non Query Based') : $name);
 		$data_query_id        = $host_group_data_array[1];
 	} elseif ($host_group_data_array[0] == 'dqi') {
 		$name = db_fetch_cell_prepared('SELECT name
 			FROM snmp_query
 			WHERE id = ?',
 			array($host_group_data_array[1]));
 
+		$name = html_escape($name);
 		$host_group_data_name = '<strong>' . __('Graph Template:') . '</strong> ' . (empty($host_group_data_array[1]) ? __('Non Query Based') : $name) . '-> ' . (empty($host_group_data_array[2]) ? __('Template Based') : get_formatted_data_query_index($leaf['host_id'], $host_group_data_array[1], $host_group_data_array[2]));
 		$data_query_id        = $host_group_data_array[1];
 		$data_query_index     = $host_group_data_array[2];
 	}
 

Fixed code: 		$name = html_escape($name);
		$name = html_escape($name);
		$name = html_escape($name);
CVE-2024-31445: Insufficient Information (NVD-CWE-noinfo)
value: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:25Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: lib/api_automation.php
Commit date: 2024-04-07 15:24:07 +0100
Commit message: Merge pull request from GHSA-vjph-r677-6pcc


Diff: diff --git a/lib/api_automation.php b/lib/api_automation.php
index e9779ab48a..84da1997d4 100644
--- a/lib/api_automation.php
+++ b/lib/api_automation.php
@@ -1802,11 +1802,11 @@ function build_graph_object_sql_having($rule, $filter) {
 			$sql_having = ' HAVING (';
 
 			$i = 0;
 
 			foreach ($field_names as $column) {
-				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE "%' . $filter . '%"';
+				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE ' . db_qstr('%' . $filter . '%');
 				$i++;
 			}
 
 			$sql_having .= ')';
 		}
@@ -5404,6 +5404,5 @@ function automation_validate_import_columns($table, &$data, &$debug_data) {
 		return false;
 	}
 
 	return true;
 }
-

Vulnerable code: 				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE "%' . $filter . '%"';

Fixed code: 				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE ' . db_qstr('%' . $filter . '%');
CVE-2015-5287: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Published: 2015-12-07T18:59Z
Repository: https://github.com/abrt/abrt
Language: C
Files changed: src/hooks/abrt-hook-ccpp.c
Commit date: 2015-11-23 14:52:53 +0100
Commit message: ccpp: save abrt core files only to new files

Prior this commit abrt-hook-ccpp saved a core file generated by a
process running a program whose name starts with "abrt" in
DUMP_LOCATION/$(basename program)-coredump. If the file was a symlink,
the hook followed and wrote core file to the symlink's target.

Addresses CVE-2015-5287

Signed-off-by: Jakub Filak <jfilak@redhat.com>

Diff: diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
index 4a31b8103..58d9c28d2 100644
--- a/src/hooks/abrt-hook-ccpp.c
+++ b/src/hooks/abrt-hook-ccpp.c
@@ -716,11 +716,12 @@ int main(int argc, char** argv)
          * Unlike dirs, mere files are ignored by abrtd.
          */
         if (snprintf(path, sizeof(path), "%s/%s-coredump", g_settings_dump_location, last_slash) >= sizeof(path))
             error_msg_and_die("Error saving '%s': truncated long file path", path);
 
-        int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+        unlink(path);
+        int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_EXCL, 0600);
         off_t core_size = copyfd_eof(STDIN_FILENO, abrt_core_fd, COPYFD_SPARSE);
         if (core_size < 0 || fsync(abrt_core_fd) != 0)
         {
             unlink(path);
             /* copyfd_eof logs the error including errno string,

Vulnerable code:         int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
Fixed code:         unlink(path);
        int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_EXCL, 0600);
CVE-2021-32806: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal. The url `https:example.org` without slashes is considered to be in the portal. When redirecting, some browsers go to `https://example.org`, others give an error. Attackers may use this to redirect victims to their site, especially as part of a phishing attack. The problem has been patched in Products.isurlinportal 1.2.0.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2021-08-02T19:15Z
Repository: https://github.com/plone/Products.isurlinportal
Language: Unknown
Commit date: 2021-07-31 14:33:49 +0200
Commit message: Merge pull request from GHSA-q3m9-9fj2-mfwr

Treat urls like https:example.org without slashes as outside the portal.
CVE-2015-5659: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-10-11T01:59Z
Repository: https://github.com/NaCl-Ltd/pref-shimane-cms
Language: Ruby
Files changed: pref-shimane-cms/lib/susanoo/search_form.rb
Commit date: 2015-10-07 13:31:38 +0900
Commit message: 検索フォームクラスごとにソート順を作成するよう修正

Diff: diff --git a/pref-shimane-cms/lib/susanoo/search_form.rb b/pref-shimane-cms/lib/susanoo/search_form.rb
index e82e2cd..372f255 100644
--- a/pref-shimane-cms/lib/susanoo/search_form.rb
+++ b/pref-shimane-cms/lib/susanoo/search_form.rb
@@ -87,17 +87,13 @@ module Susanoo
     end
 
     #
     #=== ソート順を返す
     #
+    # 子クラスでオーバーライドすること
+    #
     def order_by
-      order_option = ''
-      if self.order_column
-        direction = self.order_direction || 'ASC'
-        order_option = "#{self.order_column} #{direction}"
-      end
-      order_option.present? ? order_option : @@default_order
     end
 
     private
       #
       #== 日付型のリクエストパラメータを解析する

Vulnerable code:       order_option = ''
      if self.order_column
        direction = self.order_direction || 'ASC'
        order_option = "#{self.order_column} #{direction}"
      end
      order_option.present? ? order_option : @@default_order
Fixed code:     # 子クラスでオーバーライドすること
    #
CVE-2019-17545: Double Free (CWE-415)
value: GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2019-10-14T02:15Z
Repository: https://github.com/OSGeo/gdal
Language: C++
Files changed: gdal/ogr/ogr_expat.cpp
Commit date: 2019-08-04 21:00:33 +0200
Commit message: OGRExpatRealloc(): fix double-free when size to allocate is above the default 10MB threshold. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16178. Credit to OSS Fuzz

Diff: diff --git a/gdal/ogr/ogr_expat.cpp b/gdal/ogr/ogr_expat.cpp
index 49e2c73a13..0d6c4a9ba7 100644
--- a/gdal/ogr/ogr_expat.cpp
+++ b/gdal/ogr/ogr_expat.cpp
@@ -87,11 +87,10 @@ static void* OGRExpatMalloc( size_t size )
 static void* OGRExpatRealloc( void *ptr, size_t size )
 {
     if( CanAlloc(size) )
         return realloc(ptr, size);
 
-    free(ptr);
     return nullptr;
 }
 
 /************************************************************************/
 /*                            FillWINDOWS1252()                         */

Vulnerable code:     free(ptr);
CVE-2019-25050: Out-of-bounds Write (CWE-787)
value: netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-07-20T07:15Z
Repository: https://github.com/OSGeo/gdal
Language: C++
Files changed: gdal/frmts/netcdf/netcdfsg.cpp
Commit date: 2019-06-06 21:56:17 +0200
Commit message: netCDF: avoid buffer overflow. master only. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143. Credit to OSS Fuzz

Diff: diff --git a/gdal/frmts/netcdf/netcdfsg.cpp b/gdal/frmts/netcdf/netcdfsg.cpp
index 2da0e39dcd..b5920b6cbf 100644
--- a/gdal/frmts/netcdf/netcdfsg.cpp
+++ b/gdal/frmts/netcdf/netcdfsg.cpp
@@ -52,30 +52,25 @@ namespace nccfdriver
      * alloc: a reference to a string that will be filled with the attribute (i.e. truncated and filled with the return value)
      * Returns: a reference to the string to fill (a.k.a. string pointed to by alloc reference)
      */
     std::string& attrf(int ncid, int varId, const char * attrName, std::string& alloc)
     {
-        alloc = "";
-
         size_t len = 0;
         nc_inq_attlen(ncid, varId, attrName, &len);
-        
+
         if(len < 1)
         {
+            alloc.clear();
             return alloc;
         }
 
-        char attr_vals[NC_MAX_NAME + 1];
-        memset(attr_vals, 0, NC_MAX_NAME + 1);
+        alloc.resize(len);
+        memset(&alloc[0], 0, len);
 
         // Now look through this variable for the attribute
-        if(nc_get_att_text(ncid, varId, attrName, attr_vals) != NC_NOERR)
-        {
-            return alloc;
-        }
+        nc_get_att_text(ncid, varId, attrName, &alloc[0]);
 
-        alloc = std::string(attr_vals);
         return alloc;
     }
 
 
     /* SGeometry 

Vulnerable code:         alloc = "";

        
        char attr_vals[NC_MAX_NAME + 1];
        memset(attr_vals, 0, NC_MAX_NAME + 1);
        if(nc_get_att_text(ncid, varId, attrName, attr_vals) != NC_NOERR)
        {
            return alloc;
        }
        alloc = std::string(attr_vals);
Fixed code: 
            alloc.clear();
        alloc.resize(len);
        memset(&alloc[0], 0, len);
        nc_get_att_text(ncid, varId, attrName, &alloc[0]);
CVE-2021-45943: Out-of-bounds Write (CWE-787)
value: GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/OSGeo/gdal
Language: Unknown
Commit date: 2021-12-05 00:26:39 +0100
Commit message: Merge pull request #4944 from rouault/fix_ossfuzz_41993

PCIDSK: fix write heap-buffer-overflow. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993
CVE-2021-32610: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.1
Published: 2021-07-30T14:15Z
Repository: https://github.com/pear/Archive_Tar
Language: Unknown
Commit date: 2021-09-07 09:21:19 +0200
Commit message: Merge pull request #40 from mcdruid/master

Add tests for symlink security fixes (CVE-2021-32610) [tests + patch by Drew Webber]
CVE-2024-1485: Relative Path Traversal (CWE-23)
value: A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Published: 2024-02-14T00:15Z
Repository: https://github.com/devfile/registry-support
Language: Unknown
Commit date: 2024-02-06 09:57:50 -0500
Commit message: Merge pull request #197 from Jdubrick/security-fix

Vulnerability Fix
CVE-2021-4251: Improper Neutralization (CWE-707)
value: A vulnerability classified as problematic was found in as. This vulnerability affects the function getFullURL of the file include.cdn.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 4acad1e3d2c34c017473ceea442fb3e3e078b2bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216208.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 6.1
Published: 2022-12-18T22:15Z
Repository: https://github.com/andrewsauder/as
Language: PHP
Files changed: include.cdn.php
Commit date: 2021-11-03 15:26:21 -0400
Commit message: fix xss vulnerability

Diff: diff --git a/include.cdn.php b/include.cdn.php
index 200fd3d..4ea18df 100644
--- a/include.cdn.php
+++ b/include.cdn.php
@@ -14,11 +14,11 @@ if(!isset($scriptNest)) {
     }
 
     window.AS_APP = '<?php echo AS_APP; ?>';
 
     function getFullURL() {
-        return '<?php echo trim( getFullURL(), '/'); ?>';
+        return '<?php echo trim( htmlspecialchars( getFullURL(), ENT_QUOTES ), '/'); ?>';
     }
 
     function getBaseURL() {
         return '<?php echo getBaseURL(); ?>';
     }

Vulnerable code:         return '<?php echo trim( getFullURL(), '/'); ?>';
Fixed code:         return '<?php echo trim( htmlspecialchars( getFullURL(), ENT_QUOTES ), '/'); ?>';
CVE-2020-8904: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An arbitrary memory overwrite vulnerability in the trusted memory of Asylo exists in versions prior to 0.6.0. As the ecall_restore function fails to validate the range of the output_len pointer, an attacker can manipulate the tmp_output_len value and write to an arbitrary location in the trusted (enclave) memory. We recommend updating Asylo to version 0.6.0 or later.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.6
Published: 2020-08-12T19:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/primitives/sgx/ecalls.cc
Commit date: 2020-07-21 17:22:14 -0700
Commit message: Check for output_len range in ecall_restore

This may cause vulnerablity if pointing to trusted memory.

This issue was reported by Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and
Kang Li from Baidu Security.

PiperOrigin-RevId: 322476223
Change-Id: I8a6406e9f07a20582d4387bd9a3469dfa9cbcb12

Diff: diff --git a/asylo/platform/primitives/sgx/ecalls.cc b/asylo/platform/primitives/sgx/ecalls.cc
index 337c3283..a15ff7bc 100644
--- a/asylo/platform/primitives/sgx/ecalls.cc
+++ b/asylo/platform/primitives/sgx/ecalls.cc
@@ -60,13 +60,15 @@ int ecall_take_snapshot(char **output, uint64_t *output_len) {
 // Invokes the enclave restoring entry-point. Returns a non-zero error code on
 // failure.
 int ecall_restore(const char *input, uint64_t input_len, char **output,
                   uint64_t *output_len) {
   if (!asylo::primitives::TrustedPrimitives::IsOutsideEnclave(input,
-                                                              input_len)) {
+                                                              input_len) ||
+      !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(
+          output_len, sizeof(uint64_t))) {
     asylo::primitives::TrustedPrimitives::BestEffortAbort(
-        "ecall_restore: input found to not be in untrusted memory.");
+        "ecall_restore: input/output found to not be in untrusted memory.");
   }
   int result = 0;
   size_t tmp_output_len;
   try {
     result = asylo::Restore(input, static_cast<size_t>(input_len), output,

Vulnerable code:                                                               input_len)) {
        "ecall_restore: input found to not be in untrusted memory.");
Fixed code:                                                               input_len) ||
      !asylo::primitives::TrustedPrimitives::IsOutsideEnclave(
          output_len, sizeof(uint64_t))) {
        "ecall_restore: input/output found to not be in untrusted memory.");
CVE-2020-8905: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: A buffer length validation vulnerability in Asylo versions prior to 0.6.0 allows an attacker to read data they should not have access to. The 'enc_untrusted_recvfrom' function generates a return value which is deserialized by 'MessageReader', and copied into three different 'extents'. The length of the third 'extents' is controlled by the outside world, and not verified on copy, allowing the attacker to force Asylo to copy trusted memory data into an untrusted buffer of significantly small length.. We recommend updating Asylo to version 0.6.0 or later.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 6.5
Published: 2020-08-12T19:15Z
Repository: https://github.com/google/asylo
Language: C++
Files changed: asylo/platform/host_call/trusted/host_calls.cc
Commit date: 2020-07-21 17:22:45 -0700
Commit message: Fix vulnerability in enc_untrusted_recvfrom

Change recvfrom memcpy to check for received_buffer size to avoid
copying extra buffer.

This issue was reported by Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and
Kang Li from Baidu Security.

PiperOrigin-RevId: 322476299
Change-Id: I3606ff9ec51ec7cc4312c7555c645a2fc6e09b21

Diff: diff --git a/asylo/platform/host_call/trusted/host_calls.cc b/asylo/platform/host_call/trusted/host_calls.cc
index 87fdca24..6e37ebf0 100644
--- a/asylo/platform/host_call/trusted/host_calls.cc
+++ b/asylo/platform/host_call/trusted/host_calls.cc
@@ -980,11 +980,11 @@ ssize_t enc_untrusted_recvfrom(int sockfd, void *buf, size_t len, int flags,
     errno = FromkLinuxErrorNumber(klinux_errno);
     return result;
   }
 
   auto buffer_received = output.next();
-  memcpy(buf, buffer_received.data(), len);
+  memcpy(buf, buffer_received.data(), std::min(len, buffer_received.size()));
 
   // If |src_addr| is not NULL, and the underlying protocol provides the source
   // address, this source address is filled in. When |src_addr| is NULL, nothing
   // is filled in; in this case, |addrlen| is not used, and should also be NULL.
   if (src_addr != nullptr && addrlen != nullptr) {

Vulnerable code:   memcpy(buf, buffer_received.data(), len);
Fixed code:   memcpy(buf, buffer_received.data(), std::min(len, buffer_received.size()));