Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-0440: Insufficient Information (NVD-CWE-noinfo)
value: Attacker, with permission to submit a link or submits a link via POST  to be collected that is using the file:// protocol can then introspect host files and other relatively stored files.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T16:27Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JavaScript
Files changed: collector/utils/url/index.js
Commit date: 2024-01-11 12:29:00 -0800
Commit message: Strict link protocol validation (#577)


Diff: diff --git a/collector/utils/url/index.js b/collector/utils/url/index.js
index 3a7f9072..419c02c2 100644
--- a/collector/utils/url/index.js
+++ b/collector/utils/url/index.js
@@ -1,8 +1,11 @@
+const VALID_PROTOCOLS = ["https:", "http:"];
+
 function validURL(url) {
   try {
-    new URL(url);
+    const destination = new URL(url);
+    if (!VALID_PROTOCOLS.includes(destination.protocol)) return false;
     return true;
   } catch {}
   return false;
 }
 

Vulnerable code:     new URL(url);
Fixed code: const VALID_PROTOCOLS = ["https:", "http:"];

    const destination = new URL(url);
    if (!VALID_PROTOCOLS.includes(destination.protocol)) return false;
CVE-2024-0455: Server-Side Request Forgery (SSRF) (CWE-918)
value: The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL
```
http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance
```
which is a special IP and URL that resolves only when the request comes from within an EC2 instance. This would allow the user to see the connection/secret credentials for their specific instance and be able to manage it regardless of who deployed it.

The user would have to have pre-existing knowledge of the hosting infra which the target instance is deployed on, but if sent - would resolve if on EC2 and the proper `iptable` or firewall rule is not configured for their setup.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Published: 2024-02-26T16:27Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JSON
Files changed: cloud-deployments/aws/cloudformation/cloudformation_create_anythingllm.json
Commit date: 2024-01-11 18:37:00 -0800
Commit message: protect AWS CF deployments by automatically blocking metadata URL (#578)


Diff: diff --git a/cloud-deployments/aws/cloudformation/cloudformation_create_anythingllm.json b/cloud-deployments/aws/cloudformation/cloudformation_create_anythingllm.json
index 313a4ecd..e81e16b6 100644
--- a/cloud-deployments/aws/cloudformation/cloudformation_create_anythingllm.json
+++ b/cloud-deployments/aws/cloudformation/cloudformation_create_anythingllm.json
@@ -80,11 +80,12 @@
                 "Content-Disposition: attachment; filename=\"userdata.txt\"\n",
                 "\n",
                 "\n",
                 "#!/bin/bash\n",
                 "# check output of userdata script with sudo tail -f /var/log/cloud-init-output.log\n",
-                "sudo yum install docker -y\n",
+                "sudo yum install docker iptables -y\n",
+                "sudo iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP\n",
                 "sudo systemctl enable docker\n",
                 "sudo systemctl start docker\n",
                 "mkdir -p /home/ec2-user/anythingllm\n",
                 "touch /home/ec2-user/anythingllm/.env\n",
                 "sudo chown ec2-user:ec2-user -R /home/ec2-user/anythingllm\n",

Vulnerable code:                 "sudo yum install docker -y\n",
Fixed code:                 "sudo yum install docker iptables -y\n",
                "sudo iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP\n",
CVE-2024-0551: Improper Access Control (CWE-284)
value: Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack.

It is worth noting that the deterministic nature of the export name is lower risk as the UI for exporting would start the download at the same time, which once downloaded - deletes the export from the system.

The endpoint for exporting should simply be patched to a higher privilege level.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Published: 2024-02-27T14:15Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JavaScript
Files changed: server/endpoints/system.js
Commit date: 2024-01-14 17:10:49 -0800
Commit message: add flex role to export endpoint

Diff: diff --git a/server/endpoints/system.js b/server/endpoints/system.js
index 39b77a6a..15db895a 100644
--- a/server/endpoints/system.js
+++ b/server/endpoints/system.js
@@ -387,19 +387,23 @@ function systemEndpoints(app) {
       console.log(e.message, e);
       response.sendStatus(500).end();
     }
   });
 
-  app.get("/system/data-export", [validatedRequest], async (_, response) => {
-    try {
-      const { filename, error } = await exportData();
-      response.status(200).json({ filename, error });
-    } catch (e) {
-      console.log(e.message, e);
-      response.sendStatus(500).end();
+  app.get(
+    "/system/data-export",
+    [validatedRequest, flexUserRoleValid],
+    async (_, response) => {
+      try {
+        const { filename, error } = await exportData();
+        response.status(200).json({ filename, error });
+      } catch (e) {
+        console.log(e.message, e);
+        response.sendStatus(500).end();
+      }
     }
-  });
+  );
 
   app.get("/system/data-exports/:filename", (request, response) => {
     const exportLocation = __dirname + "/../storage/exports/";
     const sanitized = normalizePath(request.params.filename);
     const finalDestination = path.join(exportLocation, sanitized);

Vulnerable code:   app.get("/system/data-export", [validatedRequest], async (_, response) => {
    try {
      const { filename, error } = await exportData();
      response.status(200).json({ filename, error });
    } catch (e) {
      console.log(e.message, e);
      response.sendStatus(500).end();
  });
Fixed code:   app.get(
    "/system/data-export",
    [validatedRequest, flexUserRoleValid],
    async (_, response) => {
      try {
        const { filename, error } = await exportData();
        response.status(200).json({ filename, error });
      } catch (e) {
        console.log(e.message, e);
        response.sendStatus(500).end();
      }
  );
CVE-2024-3029: Improper Input Validation (CWE-20)
value: In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multi_user_mode'. The vulnerability allows an attacker to remove all existing users and potentially create a new admin user without requiring a password, leading to unauthorized access and control over the application.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2024-04-16T00:15Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JavaScript
Files changed: server/endpoints/system.js
Commit date: 2024-03-27 12:20:53 -0700
Commit message: sec: fix enable-multi-user preflight check to prevent error loop

Diff: diff --git a/server/endpoints/system.js b/server/endpoints/system.js
index 84ffac641..3c8cf6bc9 100644
--- a/server/endpoints/system.js
+++ b/server/endpoints/system.js
@@ -384,20 +384,19 @@ function systemEndpoints(app) {
   app.post(
     "/system/enable-multi-user",
     [validatedRequest],
     async (request, response) => {
       try {
-        const { username, password } = reqBody(request);
-        const multiUserModeEnabled = await SystemSettings.isMultiUserMode();
-        if (multiUserModeEnabled) {
+        if (response.locals.multiUserMode) {
           response.status(200).json({
             success: false,
             error: "Multi-user mode is already enabled.",
           });
           return;
         }
 
+        const { username, password } = reqBody(request);
         const { user, error } = await User.create({
           username,
           password,
           role: ROLES.admin,
         });

Vulnerable code:         const { username, password } = reqBody(request);
        const multiUserModeEnabled = await SystemSettings.isMultiUserMode();
        if (multiUserModeEnabled) {
Fixed code:         if (response.locals.multiUserMode) {
        const { username, password } = reqBody(request);
CVE-2024-3102: Insufficient Information (NVD-CWE-noinfo)
value: A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at the `/api/request-token` endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascertain the full username, significantly compromising system security.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-06T19:15Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JavaScript
Files changed: server/endpoints/system.js
Commit date: 2024-03-29 11:47:30 -0700
Commit message: security: patch primsa expansion on token request

Diff: diff --git a/server/endpoints/system.js b/server/endpoints/system.js
index 901276810..2e0eda844 100644
--- a/server/endpoints/system.js
+++ b/server/endpoints/system.js
@@ -103,11 +103,11 @@ function systemEndpoints(app) {
     try {
       const bcrypt = require("bcrypt");
 
       if (await SystemSettings.isMultiUserMode()) {
         const { username, password } = reqBody(request);
-        const existingUser = await User.get({ username });
+        const existingUser = await User.get({ username: String(username) });
 
         if (!existingUser) {
           await EventLogs.logEvent(
             "failed_login_invalid_username",
             {
@@ -123,11 +123,11 @@ function systemEndpoints(app) {
             message: "[001] Invalid login credentials.",
           });
           return;
         }
 
-        if (!bcrypt.compareSync(password, existingUser.password)) {
+        if (!bcrypt.compareSync(String(password), existingUser.password)) {
           await EventLogs.logEvent(
             "failed_login_invalid_password",
             {
               ip: request.ip || "Unknown IP",
               username: username || "Unknown user",

Vulnerable code:         const existingUser = await User.get({ username });
        if (!bcrypt.compareSync(password, existingUser.password)) {
Fixed code:         const existingUser = await User.get({ username: String(username) });
        if (!bcrypt.compareSync(String(password), existingUser.password)) {
CVE-2024-3150: Improper Input Validation (CWE-20)
value: In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fails to validate or check user input before passing it to the `workspace_thread` Prisma model for execution. This oversight allows attackers to craft a Prisma relation query operation that manipulates the `users` model to change a user's role to admin. Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2024-06-06T19:16Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JavaScript
Files changed: server/models/workspaceThread.js
Commit date: 2024-04-01 13:09:37 -0700
Commit message: patch prisma query expansion on threads

Diff: diff --git a/server/models/workspaceThread.js b/server/models/workspaceThread.js
index 45c9b0f11..0f99082b4 100644
--- a/server/models/workspaceThread.js
+++ b/server/models/workspaceThread.js
@@ -23,20 +23,23 @@ const WorkspaceThread = {
   },
 
   update: async function (prevThread = null, data = {}) {
     if (!prevThread) throw new Error("No thread id provided for update");
 
-    const validKeys = Object.keys(data).filter((key) =>
-      this.writable.includes(key)
-    );
-    if (validKeys.length === 0)
+    const validData = {};
+    Object.entries(data).forEach(([key, value]) => {
+      if (!this.writable.includes(key)) return;
+      validData[key] = value;
+    });
+
+    if (Object.keys(validData).length === 0)
       return { thread: prevThread, message: "No valid fields to update!" };
 
     try {
       const thread = await prisma.workspace_threads.update({
         where: { id: prevThread.id },
-        data,
+        data: validData,
       });
       return { thread, message: null };
     } catch (error) {
       console.error(error.message);
       return { thread: null, message: error.message };

Vulnerable code:     const validKeys = Object.keys(data).filter((key) =>
      this.writable.includes(key)
    );
    if (validKeys.length === 0)
        data,
Fixed code:     const validData = {};
    Object.entries(data).forEach(([key, value]) => {
      if (!this.writable.includes(key)) return;
      validData[key] = value;
    });

    if (Object.keys(validData).length === 0)
        data: validData,
CVE-2024-3152: Improper Input Validation (CWE-20)
value: mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the `/request-token`, `/workspace/:slug/thread/:threadSlug/update`, `/system/remove-logo`, `/system/logo`, and collector's `/process` endpoints. These issues are due to the application's failure to properly validate user input before passing it to `prisma` functions and other critical operations. Affected versions include the latest version prior to 1.0.0.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2024-06-06T18:15Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JavaScript
Files changed: server/models/workspaceThread.js
Commit date: 2024-04-01 13:09:37 -0700
Commit message: patch prisma query expansion on threads

Diff: diff --git a/server/models/workspaceThread.js b/server/models/workspaceThread.js
index 45c9b0f11..0f99082b4 100644
--- a/server/models/workspaceThread.js
+++ b/server/models/workspaceThread.js
@@ -23,20 +23,23 @@ const WorkspaceThread = {
   },
 
   update: async function (prevThread = null, data = {}) {
     if (!prevThread) throw new Error("No thread id provided for update");
 
-    const validKeys = Object.keys(data).filter((key) =>
-      this.writable.includes(key)
-    );
-    if (validKeys.length === 0)
+    const validData = {};
+    Object.entries(data).forEach(([key, value]) => {
+      if (!this.writable.includes(key)) return;
+      validData[key] = value;
+    });
+
+    if (Object.keys(validData).length === 0)
       return { thread: prevThread, message: "No valid fields to update!" };
 
     try {
       const thread = await prisma.workspace_threads.update({
         where: { id: prevThread.id },
-        data,
+        data: validData,
       });
       return { thread, message: null };
     } catch (error) {
       console.error(error.message);
       return { thread: null, message: error.message };

Vulnerable code:     const validKeys = Object.keys(data).filter((key) =>
      this.writable.includes(key)
    );
    if (validKeys.length === 0)
        data,
Fixed code:     const validData = {};
    Object.entries(data).forEach(([key, value]) => {
      if (!this.writable.includes(key)) return;
      validData[key] = value;
    });

    if (Object.keys(validData).length === 0)
        data: validData,
CVE-2024-5211: Path Traversal: '\..\filename' (CWE-29)
value: A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traversal attacks. This vulnerability enables the manager to read, delete, or overwrite the 'anythingllm.db' database file and other files stored in the 'storage' directory, such as internal communication keys and .env secrets. Exploitation of this vulnerability could lead to application compromise, denial of service (DoS) attacks, and unauthorized admin account takeover. The issue stems from improper validation of user-supplied input in the process of setting a custom logo for the app, which can be manipulated to achieve arbitrary file read, deletion, or overwrite, and to execute a DoS attack by deleting critical files required for the application's operation.
CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Published: 2024-06-12T12:15Z
Repository: https://github.com/mintplex-labs/anything-llm
Language: JavaScript
Files changed: collector/utils/files/index.js
Commit date: 2024-05-22 11:50:01 -0500
Commit message: patch path normalization

Diff: diff --git a/collector/utils/files/index.js b/collector/utils/files/index.js
index 9b56bb5b4..51d0a6823 100644
--- a/collector/utils/files/index.js
+++ b/collector/utils/files/index.js
@@ -120,11 +120,11 @@ function isWithin(outer, inner) {
   return !rel.startsWith("../") && rel !== "..";
 }
 
 function normalizePath(filepath = "") {
   const result = path
-    .normalize(filepath.trim())
+    .normalize(filepath.replace(/\s/g, "-").trim())
     .replace(/^(\.\.(\/|\\|$))+/, "")
     .trim();
   if (["..", ".", "/"].includes(result)) throw new Error("Invalid path.");
   return result;
 }

Vulnerable code:     .normalize(filepath.trim())
Fixed code:     .normalize(filepath.replace(/\s/g, "-").trim())
CVE-2022-41953: Untrusted Search Path (CWE-426)
value: Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2023-01-17T22:15Z
Repository: https://github.com/git-for-windows/git
Language: Unknown
Commit date: 2023-01-17 13:47:49 -0500
Commit message: Merge v2.39.1.windows.1 (#4219)

This PR takes the embargoed release tag `v2.39.1.windows.1` and merges
it into the `main` branch.

It likely that I messed something up in the order of releasing the
security release and merging the [security
advisory](https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99c).
CVE-2023-23618: Untrusted Search Path (CWE-426)
value: Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2023-02-14T21:15Z
Repository: https://github.com/git-for-windows/git
Language: Unknown
Commit date: 2023-02-14 13:19:10 -0500
Commit message: Merge pull request from GHSA-wxwv-49qw-35pm

Safe path lookup in gitk on windows
CVE-2013-2653: Improper Input Validation (CWE-20)
value: security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-11-13T00:55Z
Repository: https://github.com/chillu/silverstripe-framework
Language: PHP
Files changed: security/MemberLoginForm.php
Commit date: 2013-05-08 10:25:28 +0200
Commit message: API Restrict MemberLoginForm to POST requests for increased security

CVE-2013-2653 - Thanks to Fara Rustein of Deloitte Argentina for reporting.

Diff: diff --git a/security/MemberLoginForm.php b/security/MemberLoginForm.php
index 1e5e2bceb..cb584539c 100644
--- a/security/MemberLoginForm.php
+++ b/security/MemberLoginForm.php
@@ -87,10 +87,13 @@ class MemberLoginForm extends LoginForm {
 
 		if(isset($backURL)) {
 			$fields->push(new HiddenField('BackURL', 'BackURL', $backURL));
 		}
 
+		// Reduce attack surface by enforcing POST requests
+		$this->setFormMethod('POST', true);
+
 		parent::__construct($controller, $name, $fields, $actions);
 
 		// Focus on the email input when the page is loaded
 		Requirements::customScript(<<<JS
 			(function() {

Fixed code: 		// Reduce attack surface by enforcing POST requests
		$this->setFormMethod('POST', true);
CVE-2013-6789: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2013-11-13T00:55Z
Repository: https://github.com/chillu/silverstripe-framework
Language: PHP
Files changed: security/MemberLoginForm.php
Commit date: 2013-05-08 10:25:28 +0200
Commit message: API Restrict MemberLoginForm to POST requests for increased security

CVE-2013-2653 - Thanks to Fara Rustein of Deloitte Argentina for reporting.

Diff: diff --git a/security/MemberLoginForm.php b/security/MemberLoginForm.php
index 1e5e2bceb..cb584539c 100644
--- a/security/MemberLoginForm.php
+++ b/security/MemberLoginForm.php
@@ -87,10 +87,13 @@ class MemberLoginForm extends LoginForm {
 
 		if(isset($backURL)) {
 			$fields->push(new HiddenField('BackURL', 'BackURL', $backURL));
 		}
 
+		// Reduce attack surface by enforcing POST requests
+		$this->setFormMethod('POST', true);
+
 		parent::__construct($controller, $name, $fields, $actions);
 
 		// Focus on the email input when the page is loaded
 		Requirements::customScript(<<<JS
 			(function() {

Fixed code: 		// Reduce attack surface by enforcing POST requests
		$this->setFormMethod('POST', true);
CVE-2021-21404: Improper Input Validation (CWE-20)
value: Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2021-04-06T20:15Z
Repository: https://github.com/syncthing/syncthing
Language: Go
Files changed: lib/relay/protocol/protocol.go
Commit date: 2021-04-06 08:03:22 +0200
Commit message: Merge pull request from GHSA-x462-89pf-6r5h


Diff: diff --git a/lib/relay/protocol/protocol.go b/lib/relay/protocol/protocol.go
index 97dee8d4..0bc079ab 100644
--- a/lib/relay/protocol/protocol.go
+++ b/lib/relay/protocol/protocol.go
@@ -2,10 +2,11 @@
 
 package protocol
 
 import (
 	"errors"
+	"fmt"
 	"io"
 )
 
 const (
 	magic        = 0x9E79BC40
@@ -84,10 +85,13 @@ func ReadMessage(r io.Reader) (interface{}, error) {
 	}
 
 	if header.magic != magic {
 		return nil, errors.New("magic mismatch")
 	}
+	if header.messageLength < 0 || header.messageLength > 1024 {
+		return nil, fmt.Errorf("bad length (%d)", header.messageLength)
+	}
 
 	buf = make([]byte, int(header.messageLength))
 	if _, err := io.ReadFull(r, buf); err != nil {
 		return nil, err
 	}

Fixed code: 	"fmt"
	if header.messageLength < 0 || header.messageLength > 1024 {
		return nil, fmt.Errorf("bad length (%d)", header.messageLength)
	}
CVE-2024-27292: Insufficient Information (NVD-CWE-noinfo)
value: Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T02:52Z
Repository: https://github.com/jhpyle/docassemble
Language: Python
Files changed: docassemble_base/docassemble/base/functions.py
Commit date: 2024-02-29 11:39:00 -0500
Commit message: updated filename_invalid function

Diff: diff --git a/docassemble_base/docassemble/base/functions.py b/docassemble_base/docassemble/base/functions.py
index cd7b7a06b..6ac8335c6 100644
--- a/docassemble_base/docassemble/base/functions.py
+++ b/docassemble_base/docassemble/base/functions.py
@@ -119,11 +119,11 @@ class ReturnValue:
             return str(self.error_message)
         return str(self.value)
 
 
 def filename_invalid(filename):
-    if '../' in filename:
+    if '../' in filename or filename.startswith('/'):
         return True
     if re.search(r'[^A-Za-z0-9\_\.\-\/ ]', filename):
         return True
     if len(filename) > 268:
         return True

Vulnerable code:     if '../' in filename:
Fixed code:     if '../' in filename or filename.startswith('/'):
CVE-2015-10040: Improper Encoding or Escaping of Output (CWE-116)
value: A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getGrade/getOutOf of the file scripts/config.sh of the component Escape Sequence Handler. The manipulation leads to injection. The attack can be initiated remotely. The patch is identified as 3faa5deaa509012069afe75cd03c21bda5050a64. It is recommended to apply a patch to fix this issue. VDB-218302 is the identifier assigned to this vulnerability.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 6.5
Published: 2023-01-13T20:15Z
Repository: https://github.com/mikeizbicki/gitlearn
Language: Shell
Files changed: scripts/config.sh
Commit date: 2015-06-09 14:35:27 -0700
Commit message: fixed escape sequence vulnerability

Diff: diff --git a/scripts/config.sh b/scripts/config.sh
index db8b799..f9bb7e3 100755
--- a/scripts/config.sh
+++ b/scripts/config.sh
@@ -344,20 +344,20 @@ function isGraded {
     return `! grep '^[[:blank:]]*/' -q "$1"`
 }
 
 # $1 = the grade file
 function getGrade {
-    head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g'
+    head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g' | sed 's/[^[:digit:].]//g'
     #head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}'
 }
 
 # $1 = the grade file
 function getOutOf {
     if isGraded $1; then
-        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}'
+        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}' | sed 's/[^[:digit:].]//g'
     else
-        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}'
+        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}' | sed 's/[^[:digit:].]//g'
     fi
 }
 
 # calculates the total points for user $1 in directory $2
 function totalGrade {

Vulnerable code:     head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}'
Fixed code:     head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g' | sed 's/[^[:digit:].]//g'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}' | sed 's/[^[:digit:].]//g'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}' | sed 's/[^[:digit:].]//g'
CVE-2020-28194: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 9.8
Published: 2021-02-01T14:15Z
Repository: https://github.com/accel-ppp/accel-ppp
Language: C
Files changed: accel-pppd/radius/packet.c
Commit date: 2020-10-21 12:40:26 +0300
Commit message: radius: sanity check for vendor attribute length

Diff: diff --git a/accel-pppd/radius/packet.c b/accel-pppd/radius/packet.c
index e33e88ef..07ddf6be 100644
--- a/accel-pppd/radius/packet.c
+++ b/accel-pppd/radius/packet.c
@@ -204,10 +204,18 @@ int rad_packet_recv(int fd, struct rad_packet_t **p, struct sockaddr_in *addr)
 				ptr += vendor->len;
 
 				len -= vendor->tag + vendor->len;
 
 				n -= 4 + vendor->tag + vendor->len;
+				if (len < 0) {
+					log_ppp_warn("radius:packet invalid vendor attribute len received\n");
+					goto out_err;
+				}
+				if (2 + len > n) {
+					log_ppp_warn("radius:packet: too long vendor attribute received (%i, %i)\n", id, len);
+					goto out_err;
+				}
 			} else
 				log_ppp_warn("radius:packet: vendor %i not found\n", id);
 		} else
 			vendor = NULL;
 		da = rad_dict_find_attr_id(vendor, id);

Fixed code: 				if (len < 0) {
					log_ppp_warn("radius:packet invalid vendor attribute len received\n");
					goto out_err;
				}
				if (2 + len > n) {
					log_ppp_warn("radius:packet: too long vendor attribute received (%i, %i)\n", id, len);
					goto out_err;
				}
CVE-2020-15179: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9
Published: 2020-09-15T18:15Z
Repository: https://github.com/InternationalScratchWiki/wiki-scratchsig
Language: PHP
Files changed: ScratchSig2.php
Commit date: 2020-09-14 20:13:48 -0700
Commit message: <scratchsig><script>location='https://www.youtube.com/watch?v=dQw4w9WgXcQ';</script></scratchsig>
Diff: diff --git a/ScratchSig2.php b/ScratchSig2.php
index cde6d27..1753138 100644
--- a/ScratchSig2.php
+++ b/ScratchSig2.php
@@ -65,11 +65,11 @@ function sigGetAvatarUrl ($username) {
 
 
 // Called to output HTML for <scratchsig> tag
 
 function sigRenderTag ($input, array $args, Parser $parser, PPFrame $frame) {
-    $username = $input;
+    $username = htmlspecialchars($input);
 
     $img_url = sigGetAvatarUrl($username);
 
     $o =  '<br>'
         . '<span class="scratch-sig">'

Vulnerable code:     $username = $input;
Fixed code:     $username = htmlspecialchars($input);
CVE-2021-25979: Insufficient Session Expiration (CWE-613)
value: Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 9.8
Published: 2021-11-08T15:15Z
Repository: https://github.com/apostrophecms/apostrophe
Language: JavaScript
Files changed: modules/@apostrophecms/i18n/index.js, modules/@apostrophecms/task/index.js
Commit date: 2021-09-08 10:16:57 -0400
Commit message: session object should exist in task reqs for better compatibility

Diff: diff --git a/modules/@apostrophecms/i18n/index.js b/modules/@apostrophecms/i18n/index.js
index 7a0249d5e..dc0990df2 100644
--- a/modules/@apostrophecms/i18n/index.js
+++ b/modules/@apostrophecms/i18n/index.js
@@ -465,13 +465,13 @@ module.exports = {
           defaultLocale: self.defaultLocale,
           locales: self.locales,
           debug: self.debug,
           show: self.show,
           action: self.action,
-          crossDomainClipboard: req.session.aposCrossDomainClipboard
+          crossDomainClipboard: req.session && req.session.aposCrossDomainClipboard
         };
-        if (req.session.aposCrossDomainClipboard) {
+        if (req.session && req.session.aposCrossDomainClipboard) {
           req.session.aposCrossDomainClipboard = null;
         }
         return result;
       },
       getBrowserBundles(locale) {
diff --git a/modules/@apostrophecms/task/index.js b/modules/@apostrophecms/task/index.js
index 88515529c..fdf9dd59d 100644
--- a/modules/@apostrophecms/task/index.js
+++ b/modules/@apostrophecms/task/index.js
@@ -212,11 +212,12 @@ module.exports = {
             self.apos.util.warnDevOnce('old-i18n-req-helper', stripIndent`
               The req.__() and res.__() functions are deprecated and do not localize in A3.
               Use req.t instead.
             `);
             return key;
-          }
+          },
+          session: {}
         };
         addCloneMethod(req);
         req.res.__ = req.__;
         const { role, ..._properties } = options || {};
         Object.assign(req, _properties);

Vulnerable code:           crossDomainClipboard: req.session.aposCrossDomainClipboard
        if (req.session.aposCrossDomainClipboard) {
          }
Fixed code:           crossDomainClipboard: req.session && req.session.aposCrossDomainClipboard
        if (req.session && req.session.aposCrossDomainClipboard) {
          },
          session: {}
CVE-2018-1002200: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2018-07-25T17:29Z
Repository: https://github.com/codehaus-plexus/plexus-archiver
Language: Unknown
Commit date: 2018-05-06 13:43:08 +0200
Commit message: Merge pull request #87 from odinn1984/fix/fail_on_outside_target_files

fix: fail when trying to extract outside of dest dir
CVE-2013-0262: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2013-02-08T20:55Z
Repository: https://github.com/rack/rack
Language: Ruby
Files changed: lib/rack/file.rb
Commit date: 2013-02-07 18:36:09 -0800
Commit message: Prevent symlink path traversals

 * Closes CVE-2013-0262

Diff: diff --git a/lib/rack/file.rb b/lib/rack/file.rb
index 090a0015..ee58a1a7 100644
--- a/lib/rack/file.rb
+++ b/lib/rack/file.rb
@@ -39,23 +39,18 @@ module Rack
       end
 
       path_info = Utils.unescape(env["PATH_INFO"])
       parts = path_info.split SEPS
 
-      parts.inject(0) do |depth, part|
-        case part
-        when '', '.'
-          depth
-        when '..'
-          return fail(404, "Not Found") if depth - 1 < 0
-          depth - 1
-        else
-          depth + 1
-        end
+      clean = []
+
+      parts.each do |part|
+        next if part.empty? || part == '.'
+        part == '..' ? clean.pop : clean << part
       end
 
-      @path = F.join(@root, *parts)
+      @path = F.join(@root, *clean)
 
       available = begin
         F.file?(@path) && F.readable?(@path)
       rescue SystemCallError
         false

Vulnerable code:       parts.inject(0) do |depth, part|
        case part
        when '', '.'
          depth
        when '..'
          return fail(404, "Not Found") if depth - 1 < 0
          depth - 1
        else
          depth + 1
        end
      @path = F.join(@root, *parts)
Fixed code:       clean = []

      parts.each do |part|
        next if part.empty? || part == '.'
        part == '..' ? clean.pop : clean << part
      @path = F.join(@root, *clean)
CVE-2013-0263: Insufficient Information (NVD-CWE-noinfo)
value: Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2013-02-08T20:55Z
Repository: https://github.com/rack/rack
Language: Ruby
Files changed: lib/rack/session/cookie.rb
Commit date: 2013-02-07 14:47:10 -0800
Commit message: Use secure_compare for hmac comparison

 * Closes CVE-2013-0263

Diff: diff --git a/lib/rack/session/cookie.rb b/lib/rack/session/cookie.rb
index 75986758..be537a9c 100644
--- a/lib/rack/session/cookie.rb
+++ b/lib/rack/session/cookie.rb
@@ -157,11 +157,11 @@ module Rack
       end
 
       def digest_match?(data, digest)
         return unless data && digest
         @secrets.any? do |secret|
-          digest == generate_hmac(data, secret)
+          Rack::Utils.secure_compare(digest, generate_hmac(data, secret))
         end
       end
 
       def generate_hmac(data, secret)
         OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, secret, data)

Vulnerable code:           digest == generate_hmac(data, secret)
Fixed code:           Rack::Utils.secure_compare(digest, generate_hmac(data, secret))
CVE-2013-0263: Insufficient Information (NVD-CWE-noinfo)
value: Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2013-02-08T20:55Z
Repository: https://github.com/rack/rack
Language: Ruby
Files changed: lib/rack/utils.rb, test/spec_utils.rb
Commit date: 2013-02-07 14:46:20 -0800
Commit message: Add secure_compare to Rack::Utils

Conflicts:
	test/spec_utils.rb

Diff: diff --git a/lib/rack/utils.rb b/lib/rack/utils.rb
index 3ffdb3a2..561e46e5 100644
--- a/lib/rack/utils.rb
+++ b/lib/rack/utils.rb
@@ -393,10 +393,22 @@ module Rack
       end
       ranges
     end
     module_function :byte_ranges
 
+    # Constant time string comparison.
+    def secure_compare(a, b)
+      return false unless bytesize(a) == bytesize(b)
+
+      l = a.unpack("C*")
+
+      r, i = 0, -1
+      b.each_byte { |v| r |= v ^ l[i+=1] }
+      r == 0
+    end
+    module_function :secure_compare
+
     # Context allows the use of a compatible middleware at different points
     # in a request handling stack. A compatible middleware must define
     # #context which should take the arguments env and app. The first of which
     # would be the request environment. The second of which would be the rack
     # application that the request would be forwarded to.
diff --git a/test/spec_utils.rb b/test/spec_utils.rb
index de28a4f2..622b8ff5 100644
--- a/test/spec_utils.rb
+++ b/test/spec_utils.rb
@@ -352,10 +352,15 @@ describe Rack::Utils do
 
   should "return the bytesize of String" do
     Rack::Utils.bytesize("FOO\xE2\x82\xAC").should.equal 6
   end
 
+  should "should perform constant time string comparison" do
+    Rack::Utils.secure_compare('a', 'a').should.equal true
+    Rack::Utils.secure_compare('a', 'b').should.equal false
+  end
+
   should "return status code for integer" do
     Rack::Utils.status_code(200).should.equal 200
   end
 
   should "return status code for string" do

Fixed code:     # Constant time string comparison.
    def secure_compare(a, b)
      return false unless bytesize(a) == bytesize(b)

      l = a.unpack("C*")

      r, i = 0, -1
      b.each_byte { |v| r |= v ^ l[i+=1] }
      r == 0
    end
    module_function :secure_compare

  should "should perform constant time string comparison" do
    Rack::Utils.secure_compare('a', 'a').should.equal true
    Rack::Utils.secure_compare('a', 'b').should.equal false
  end
CVE-2021-39190: Missing Authorization (CWE-862)
value: The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.3
Published: 2022-09-22T17:15Z
Repository: https://github.com/pluginsGLPI/sccm
Language: PHP
Files changed: front/config.form.php
Commit date: 2022-05-31 15:38:29 +0200
Commit message: Merge pull request from GHSA-3324-57w6-jxcq


Diff: diff --git a/front/config.form.php b/front/config.form.php
index 5478c83..d4fc4e5 100644
--- a/front/config.form.php
+++ b/front/config.form.php
@@ -30,14 +30,12 @@
  */
 
 include ('../../../inc/includes.php');
 require_once('../inc/config.class.php');
 
-Session::haveRight("config", UPDATE);
 
-Html::header(__("Setup - SCCM", "sccm"), $_SERVER["PHP_SELF"],
-             "plugins", "sccm", "configuration");
+Session::checkRight("config", UPDATE);
 
 $PluginSccmConfig = new PluginSccmConfig();
 
 if (isset($_POST["update"])) {
    $PluginSccmConfig->update($_POST);
@@ -51,8 +49,9 @@ if (isset($_POST["update"])) {
 
 
    Html::back();
 }
 
+Html::header(__("Setup - SCCM", "sccm"), $_SERVER["PHP_SELF"],
+             "plugins", "sccm", "configuration");
 $PluginSccmConfig->showConfigForm($PluginSccmConfig);
-
 Html::footer();
\ No newline at end of file

Vulnerable code: Session::haveRight("config", UPDATE);
Html::header(__("Setup - SCCM", "sccm"), $_SERVER["PHP_SELF"],
             "plugins", "sccm", "configuration");

Fixed code: Session::checkRight("config", UPDATE);
Html::header(__("Setup - SCCM", "sccm"), $_SERVER["PHP_SELF"],
             "plugins", "sccm", "configuration");
CVE-2014-4301: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) resources.js or (2) resources.css in ajenti:static/, related to the traceback page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-18T14:55Z
Repository: https://github.com/Eugeny/ajenti
Language: Python
Files changed: ajenti/routing.py
Commit date: 2014-06-08 13:05:59 +0300
Commit message: [http] fix traceback page xss

Diff: diff --git a/ajenti/routing.py b/ajenti/routing.py
index 6df2e49a..cc460f51 100644
--- a/ajenti/routing.py
+++ b/ajenti/routing.py
@@ -1,5 +1,6 @@
+import cgi
 import socketio
 import traceback
 
 from ajenti.http import HttpHandler
 from ajenti.api import BasePlugin, plugin, persistent, rootcontext
@@ -88,6 +89,6 @@ class CentralDispatcher (BasePlugin, HttpHandler):
                 <pre>
 %s
                 </pre>
             </body>
         </html>
-        """ % stack
+        """ % cgi.escape(stack)

Vulnerable code:         """ % stack
Fixed code: import cgi
        """ % cgi.escape(stack)