hitoshura25/cvefixes huggingface dataset:
CVE-2023-45143 (JavaScript, published 2023-10-12T17:15Z)
Description: value: Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.
Severity: nan (CVSS v3 base score: 3.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/nodejs/undici
Files changed:
lib/fetch/index.js
test/fetch/redirect-cross-origin-header.js
Commit message: Merge pull request from GHSA-wqq4-5wpv-mx2g

* fix: delete 'cookie' and 'host' headers on cross-origin redirect

* apply suggestion

Vulnerable code:

Fixed code:

    // "Cookie" and "Host" are forbidden request-headers, which undici doesn't implement.
    request.headersList.delete('cookie')
    request.headersList.delete('host')
'use strict'

const { test } = require('tap')
const { createServer } = require('http')
const { once } = require('events')
const { fetch } = require('../..')

test('Cross-origin redirects clear forbidden headers', async (t) => {
  t.plan(5)

  const server1 = createServer((req, res) => {
    t.equal(req.headers.cookie, undefined)
    t.equal(req.headers.authorization, undefined)

    res.end('redirected')
  }).listen(0)

  const server2 = createServer((req, res) => {
    t.equal(req.headers.authorization, 'test')
    t.equal(req.headers.cookie, 'ddd=dddd')

    res.writeHead(302, {
      ...req.headers,
      Location: `http://localhost:${server1.address().port}`
    })
    res.end()
  }).listen(0)

  t.teardown(() => {
    server1.close()
    server2.close()
  })

  await Promise.all([
    once(server1, 'listening'),
    once(server2, 'listening')
  ])

  const res = await fetch(`http://localhost:${server2.address().port}`, {
    headers: {
      Authorization: 'test',
      Cookie: 'ddd=dddd'
    }
  })

  const text = await res.text()
  t.equal(text, 'redirected')
})
CVE-2024-24750 (JavaScript, published 2024-02-16T22:15Z)
Description: value: Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/nodejs/undici
Files changed:
lib/fetch/index.js
test/fetch/pull-dont-push.js
Commit message: Merge pull request from GHSA-9f24-jqhm-jfcw

* fetch: pull don't push

Signed-off-by: Matteo Collina <hello@matteocollina.com>

* added tests

Signed-off-by: Matteo Collina <hello@matteocollina.com>

---------

Signed-off-by: Matteo Collina <hello@matteocollina.com>

Vulnerable code:
      async start (controller) {
        while (true) {
      type: 'bytes'

Fixed code:
      async pull (controller) {
        while (controller.desiredSize >= 0) {
      queuingStrategy: new ByteLengthQueuingStrategy({ highWaterMark: 16384 }),
      highWaterMark: 16384,
      type: 'bytes',
      queuingStrategy: new ByteLengthQueuingStrategy({ highWaterMark: 16384 })
'use strict'

const { test } = require('node:test')
const assert = require('node:assert')
const { fetch } = require('../..')
const { createServer } = require('http')
const { once } = require('events')
const { Readable, pipeline } = require('stream')
const { setTimeout: sleep } = require('timers/promises')

const { closeServerAsPromise } = require('../utils/node-http')

test('Allow the usage of custom implementation of AbortController', async (t) => {
  let count = 0
  let socket
  const server = createServer((req, res) => {
    res.statusCode = 200
    socket = res.socket

    // infinite stream
    const stream = new Readable({
      read () {
        this.push('a')
        if (count++ > 1000000) {
          this.push(null)
        }
      }
    })

    pipeline(stream, res, () => {})
  })

  t.after(closeServerAsPromise(server))

  server.listen(0)
  await once(server, 'listening')

  t.diagnostic('server listening on port %d', server.address().port)
  const res = await fetch(`http://localhost:${server.address().port}`)
  t.diagnostic('fetched')

  // Some time is needed to fill the buffer
  await sleep(1000)

  assert.strictEqual(socket.bytesWritten < 1024 * 1024, true) // 1 MB
  socket.destroy()

  // consume the  stream
  try {
    /* eslint-disable-next-line no-empty, no-unused-vars */
    for await (const chunk of res.body) {}
  } catch {}
})
CVE-2024-24758 (JavaScript, published 2024-02-16T22:15Z)
Description: value: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/nodejs/undici
Files changed:
lib/fetch/index.js
test/fetch/redirect-cross-origin-header.js
Commit message: Merge pull request from GHSA-3787-6prv-h9w3

Signed-off-by: Matteo Collina <hello@matteocollina.com>

Vulnerable code:
  const { strictEqual } = tspl(t, { plan: 5 })
      Cookie: 'ddd=dddd'

Fixed code:
    // https://fetch.spec.whatwg.org/#authentication-entries
    request.headersList.delete('proxy-authorization', true)

  const { strictEqual } = tspl(t, { plan: 6 })
    strictEqual(req.headers['proxy-authorization'], undefined)
      Cookie: 'ddd=dddd',
      'Proxy-Authorization': 'test'
CVE-2024-30260 (JavaScript, published 2024-04-04T16:15Z)
Description: value: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nodejs/undici
Files changed:
lib/handler/redirect-handler.js
test/redirect-cross-origin-header.js
Commit message: Merge pull request from GHSA-m4v8-wqvr-p9f7

Signed-off-by: Matteo Collina <hello@matteocollina.com>

Vulnerable code:
  if (unknownOrigin && (header.length === 13 || header.length === 6)) {
    return name === 'authorization' || name === 'cookie'

Fixed code:
  if (unknownOrigin && (header.length === 13 || header.length === 6 || header.length === 19)) {
    return name === 'authorization' || name === 'cookie' || name === 'proxy-authorization'
'use strict'

const { test } = require('node:test')
const { tspl } = require('@matteo.collina/tspl')
const { createServer } = require('node:http')
const { once } = require('node:events')
const { request } = require('..')

test('Cross-origin redirects clear forbidden headers', async (t) => {
  const { strictEqual } = tspl(t, { plan: 6 })

  const server1 = createServer((req, res) => {
    strictEqual(req.headers.cookie, undefined)
    strictEqual(req.headers.authorization, undefined)
    strictEqual(req.headers['proxy-authorization'], undefined)

    res.end('redirected')
  }).listen(0)

  const server2 = createServer((req, res) => {
    strictEqual(req.headers.authorization, 'test')
    strictEqual(req.headers.cookie, 'ddd=dddd')

    res.writeHead(302, {
      ...req.headers,
      Location: `http://localhost:${server1.address().port}`
    })
    res.end()
  }).listen(0)

  t.after(() => {
    server1.close()
    server2.close()
  })

  await Promise.all([
    once(server1, 'listening'),
    once(server2, 'listening')
  ])

  const res = await request(`http://localhost:${server2.address().port}`, {
    maxRedirections: 1,
    headers: {
      Authorization: 'test',
      Cookie: 'ddd=dddd',
      'Proxy-Authorization': 'test'
    }
  })

  const text = await res.body.text()
  strictEqual(text, 'redirected')
})
CVE-2024-38372 (JavaScript, published 2024-07-08T21:15Z)
Description: value: Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nodejs/undici
Files changed:
benchmarks/fetch/body-arraybuffer.mjs
lib/web/fetch/body.js
lib/web/fetch/util.js
Commit message: perf: avoid unnecessary clone (#3117)

* perf(fetch): improve body mixin methods

* perf: avoid unnecessary clone

Vulnerable code:
      }, instance)
        return new Uint8Array(bytes).buffer
      }, instance)
      return consumeBody(this, utf8DecodeBytes, instance)
      return consumeBody(this, parseJSONFromBytes, instance)
      }, instance)
async function consumeBody (object, convertBytesToJSValue, instance) {
    successSteps(new Uint8Array())
  await fullyReadBody(object[kState].body, successSteps, errorSteps)
async function fullyReadBody (body, processBody, processBodyError) {
    const result = await readAllBytes(reader)
    successSteps(result)
async function readAllBytes (reader) {

Fixed code:
import { group, bench, run } from 'mitata'
import { Response } from '../../lib/web/fetch/response.js'

const settings = {
  small: 2 << 8,
  middle: 2 << 12,
  long: 2 << 16
}

for (const [name, length] of Object.entries(settings)) {
  const buffer = Buffer.allocUnsafe(length).map(() => (Math.random() * 100) | 0)
  group(`${name} (length ${length})`, () => {
    bench('Response#arrayBuffer', async () => {
      return await new Response(buffer).arrayBuffer()
    })

    // for comparison
    bench('Response#text', async () => {
      return await new Response(buffer).text()
    })
  })
}

await run()
      }, instance, false)
        // Note: arrayBuffer already cloned.
        return bytes.buffer
      }, instance, true)
      return consumeBody(this, utf8DecodeBytes, instance, false)
      return consumeBody(this, parseJSONFromBytes, instance, false)
      }, instance, false)
 * @param {boolean} [shouldClone]
async function consumeBody (object, convertBytesToJSValue, instance, shouldClone) {
    successSteps(Buffer.allocUnsafe(0))
  await fullyReadBody(object[kState].body, successSteps, errorSteps, shouldClone)
async function fullyReadBody (body, processBody, processBodyError, shouldClone) {
    successSteps(await readAllBytes(reader, shouldClone))
 * @param {boolean} [shouldClone]
async function readAllBytes (reader, shouldClone) {
      if (bytes.length === 1) {
        const { buffer, byteOffset, byteLength } = bytes[0]
        if (shouldClone === false) {
          return Buffer.from(buffer, byteOffset, byteLength)
        }
        return Buffer.from(buffer.slice(byteOffset, byteOffset + byteLength), 0, byteLength)
      }
CVE-2014-9753 (PHP, published 2020-02-11T18:15Z)
Description: value: confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/atutor/ATutor
Files changed:
confirm.php
Commit message: Added a confirmation code to auto_login URL to fix bug where anyone can login as anyone.


Vulnerable code:
				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'">' . _AT("go_to_my_start_page") . '</a></p>';
	if ($row['member_id'] != '') 

Fixed code:
				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'&code=' . $code .'">' . _AT("go_to_my_start_page") . '</a></p>';
				$_REQUEST["code"] = $code;

	$code = substr(md5($e . $row['creation_date'] . $id), 0, 10);
	if ($row['member_id'] != '' && isset($_REQUEST['code']) && $_REQUEST['code'] == $code)
CVE-2015-1583 (PHP, published 2020-03-02T16:15Z)
Description: value: Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/atutor/ATutor
Files changed:
mods/_core/users/create_user.php
Commit message: 5566 check to make sure user is not being created via CRSF remote form


Vulnerable code:

Fixed code:
// Prevent remote access via CSRF: 5566
if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}
CVE-2015-1583 (PHP, published 2020-03-02T16:15Z)
Description: value: Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/atutor/ATutor
Files changed:
mods/_core/users/admins/create.php
Commit message: 5566 added chech on referer to ensure it is in the pages array, to prevent remote access via CSRF


Vulnerable code:

Fixed code:
if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}
CVE-2015-1583 (PHP, published 2020-03-02T16:15Z)
Description: value: Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/atutor/ATutor
Files changed:
include/lib/vital_funcs.inc.php
mods/_core/users/admins/create.php
mods/_core/users/create_user.php
Commit message: 5566 created a more general function to check referer, and updated create user and create admin to use it


Vulnerable code:

if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}
if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}

Fixed code:
/**
 * Check if referer is in the $_pages array to prevent CSRF access
 * @access public
 * @return error message access denied
 */
function check_referer(){
    global $_pages, $_base_href, $msg;
    if(isset($_SERVER['HTTP_REFERER']) && $_SERVER['HTTP_REFERER'] !='' && $_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
        $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
        if( !in_array($_pages[$referer_script], $_pages)){
			$msg->addError('ACCESS_DENIED');
			require(AT_INCLUDE_PATH.'header.inc.php'); 
			require(AT_INCLUDE_PATH.'footer.inc.php'); 
			exit;
        }
    }
}
// Prevent remote access via CSRF: 5566
// Ref include/lib/vitals-inc.php
check_referer();
// Ref include/lib/vitals-inc.php
check_referer();
CVE-2016-2539 (PHP, published 2017-02-07T15:59Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for requests that upload arbitrary files and execute arbitrary PHP code via vectors involving a crafted zip file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/atutor/ATutor
Files changed:
mods/_core/modules/install_modules.php
themes/default/admin/modules/install_modules.tmpl.php
Commit message: 5632,5644 removed array_multisort to fix module install issues, and added csrftoken to fix postential CSRF attack


Vulnerable code:
				header('Location: module_install_step_1.php?mod='.urlencode($module_folder).SEP.'new=1');
				exit;
		header('Location: '.AT_BASE_HREF.'mods/_core/modules/module_install_step_2.php?mod='.urlencode($dir_name).SEP.'new=1'.SEP.'mod_in=1');
		exit;
    $sort_by_version = array_multisort($version, SORT_DESC, $module_list_array);
function select_atversion(){ 
        if($version == VERSION){
<?php echo select_atversion(); ?>

Fixed code:


			        if($_POST['csrftoken'] != $_SESSION['token']){
                        $msg->addError('ACCESS_DENIED');
                    } else {
                    
                        header('Location: module_install_step_1.php?mod='.urlencode($module_folder).SEP.'new=1');                        
                        exit;
                    }
				//header('Location: module_install_step_1.php?mod='.urlencode($module_folder).SEP.'new=1');
				//exit;
	// Check for potential  CSRF
        if($_POST['csrftoken'] != $_SESSION['token']){
                $msg->addError('ACCESS_DENIED');
        } else {
            header('Location: '.AT_BASE_HREF.'mods/_core/modules/module_install_step_2.php?mod='.urlencode($dir_name).SEP.'new=1'.SEP.'mod_in=1');
            exit;
        }
    //$sort_by_version = array_multisort($version, SORT_DESC, $module_list_array);
function select_atversion($v=0){ 
        if($version == $v){
            $menu .= '<option value="'.$version.'" selected="selected">'.$version.'</option>';
        }else if($version == VERSION){
			<input type="hidden" name="csrftoken"  value="<?php echo $_SESSION['token'];?>" />
<input type="hidden" name="csrftoken"  value="<?php echo $_SESSION['token'];?>" />
<?php 

if(isset($_POST['atversions'])){
    $v = htmlspecialchars($_POST['atversions']);
    $_SESSION['atversion'] = $_POST['atversions'];
} elseif(isset($_SESSION['atversion'] )){
    $v = substr($_SESSION['atversion'], 0, 3);
} else {
    $v = substr(VERSION, 0, 3);
}
echo select_atversion($v); 

?>
<input type="hidden" name="csrftoken"  value="<?php echo $_SESSION['token'];?>" />
CVE-2016-2555 (PHP, published 2017-04-13T14:59Z)
Description: value: SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/atutor/ATutor
Files changed:
include/lib/mysql_connect.inc.php
Commit message: Update mysql_connect.inc.php

This one patch, patches all SQL Injection that I found

Vulnerable code:
    if(defined('MYSQLI_ENABLED')){
        // mysqli_real_escape_string requires 2 params, breaking wherever
        // current $addslashes with 1 param exists. So hack with trim and 
        // manually run mysqli_real_escape_string requires during sanitization below
        $addslashes   = 'trim';
    }else{
        $addslashes   = 'mysql_real_escape_string';
    }
?>

Fixed code:
    // if get_magic_quotes_gpc is off, we set our own handler
    $addslashes   = 'mysql_real_escape_string';
?>
CVE-2016-2555 (Unknown, published 2017-04-13T14:59Z)
Description: value: SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/atutor/ATutor
Files changed:
Commit message: Merge pull request #106 from net-ninja/patch-1

Update mysql_connect.inc.php to replace mysqli trim with mysql_real_escape_string to properly filter potential injection attempts, thx mr_me aka net-ninja

Vulnerable code:

Fixed code: