hitoshura25/cvefixes huggingface dataset:
CVE-2024-3570 (JSON, published 2024-04-10T17:15Z)
Description: value: A stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating the ChatBot responses, an attacker can inject malicious scripts to perform actions on behalf of the user, such as creating a new admin account or changing the user's password, leading to a complete takeover of the AnythingLLM application. The vulnerability stems from the improper sanitization of user and ChatBot input, specifically through the use of `dangerouslySetInnerHTML`. Successful exploitation requires convincing an admin to add a malicious LocalAI ChatBot to their AnythingLLM instance.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mintplex-labs/anything-llm
Files changed:
frontend/package.json
frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/HistoricalMessage/index.jsx
frontend/yarn.lock
Commit message: Patch minor XSS opportunity where user can self-XSS themselves.  (#574)

Patch minor XSS opportunity where user can self-XSS themselvess. There is not real vuln here as any instance is not public facing

Vulnerable code:
                dangerouslySetInnerHTML={{ __html: renderMarkdown(message) }}

Fixed code:
    "dompurify": "^3.0.8",
import createDOMPurify from "dompurify";
const DOMPurify = createDOMPurify(window);
                dangerouslySetInnerHTML={{
                  __html: DOMPurify.sanitize(renderMarkdown(message)),
                }}
dompurify@^3.0.8:
  version "3.0.8"
  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.0.8.tgz#e0021ab1b09184bc8af7e35c7dd9063f43a8a437"
  integrity sha512-b7uwreMYL2eZhrSCRC4ahLTeZcPZxSmYfmcQGXGkXiZSNW1X85v+SDM5KsWcpivIiUBH47Ji7NtyUdpLeF5JZQ==
CVE-2024-5211 (JavaScript, published 2024-06-12T12:15Z)
Description: value: A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traversal attacks. This vulnerability enables the manager to read, delete, or overwrite the 'anythingllm.db' database file and other files stored in the 'storage' directory, such as internal communication keys and .env secrets. Exploitation of this vulnerability could lead to application compromise, denial of service (DoS) attacks, and unauthorized admin account takeover. The issue stems from improper validation of user-supplied input in the process of setting a custom logo for the app, which can be manipulated to achieve arbitrary file read, deletion, or overwrite, and to execute a DoS attack by deleting critical files required for the application's operation.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Repository: https://github.com/mintplex-labs/anything-llm
Files changed:
collector/utils/files/index.js
Commit message: patch path normalization


Vulnerable code:
    .normalize(filepath.trim())

Fixed code:
    .normalize(filepath.replace(/\s/g, "-").trim())
CVE-2024-5216 (JavaScript, published 2024-06-25T11:15Z)
Description: value: A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption. Specifically, the issue arises from the application's failure to limit the size of usernames, enabling attackers to create users with excessively bulky texts in the username field. This exploit results in the user management panel becoming unresponsive, preventing administrators from performing critical user management actions such as editing, suspending, or deleting users. The impact of this vulnerability includes administrative paralysis, compromised security, and operational disruption, as it allows malicious users to perpetuate their presence within the system indefinitely, undermines the system's security posture, and degrades overall system performance.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mintplex-labs/anything-llm
Files changed:
server/endpoints/system.js
server/models/user.js
Commit message: enfore min and max username lengths to prevent DOS via spam-length names


Vulnerable code:
        updates.username = String(username);
          username,
          role,
          updates[key] = this.castColumnValue(key, value);

Fixed code:
        updates.username = User.validations.username(String(username));
  validations: {
    username: (newValue = "") => {
      try {
        if (String(newValue).length > 100)
          throw new Error("Username cannot be longer than 100 characters");
        if (String(newValue).length < 2)
          throw new Error("Username must be at least 2 characters");
        return String(newValue);
      } catch (e) {
        throw new Error(e.message);
      }
    },
  },

          username: this.validations.username(username),
          role: String(role),
          if (this.validations.hasOwnProperty(key)) {
            updates[key] = this.validations[key](
              this.castColumnValue(key, value)
            );
          } else {
            updates[key] = this.castColumnValue(key, value);
          }
CVE-2022-41953 (Unknown, published 2023-01-17T22:15Z)
Description: value: Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/git-for-windows/git
Files changed:
Commit message: Merge v2.39.1.windows.1 (#4219)

This PR takes the embargoed release tag `v2.39.1.windows.1` and merges
it into the `main` branch.

It likely that I messed something up in the order of releasing the
security release and merging the [security
advisory](https://github.com/git-for-windows/git/security/advisories/GHSA-v4px-mx59-w99c).

Vulnerable code:

Fixed code:
CVE-2023-23618 (Unknown, published 2023-02-14T21:15Z)
Description: value: Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/git-for-windows/git
Files changed:
Commit message: Merge pull request from GHSA-wxwv-49qw-35pm

Safe path lookup in gitk on windows

Vulnerable code:

Fixed code:
CVE-2021-21252 (JavaScript, published 2021-01-13T19:15Z)
Description: value: The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/jquery-validation/jquery-validation
Files changed:
src/core.js
Commit message: Core: fixed Regular Expression Denial of Service vulnerability (#2371)

ReDoS, or Regular Expression Denial of Service, is a vulnerability affecting
poorly constructed and potentially inefficient regular expressions which can
make them perform extremely badly given a creatively constructed input string.

GHSL-2020-294

credits to @erik-krogh for reporting the issue and providing a fix

Vulnerable code:
			return this.optional( element ) || /^(?:(?:(?:https?|ftp):)?\/\/)(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,})).?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test( value );

Fixed code:
			return this.optional( element ) || /^(?:(?:(?:https?|ftp):)?\/\/)(?:\S+(?::\S*)?@)?(?:(?!(?:10|127)(?:\.\d{1,3}){3})(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)+(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/i.test( value );
CVE-2013-2653 (PHP, published 2013-11-13T00:55Z)
Description: value: security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/chillu/silverstripe-framework
Files changed:
security/MemberLoginForm.php
Commit message: API Restrict MemberLoginForm to POST requests for increased security

CVE-2013-2653 - Thanks to Fara Rustein of Deloitte Argentina for reporting.


Vulnerable code:

Fixed code:
		// Reduce attack surface by enforcing POST requests
		$this->setFormMethod('POST', true);
CVE-2013-6789 (PHP, published 2013-11-13T00:55Z)
Description: value: security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local attackers to obtain sensitive information by reading web-server access logs, web-server Referer logs, or the browser history, a similar vulnerability to CVE-2013-2653.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/chillu/silverstripe-framework
Files changed:
security/MemberLoginForm.php
Commit message: API Restrict MemberLoginForm to POST requests for increased security

CVE-2013-2653 - Thanks to Fara Rustein of Deloitte Argentina for reporting.


Vulnerable code:

Fixed code:
		// Reduce attack surface by enforcing POST requests
		$this->setFormMethod('POST', true);
CVE-2024-33904 (C++, published 2024-04-29T06:15Z)
Description: value: In plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arbitrary assembly code by writing to a predictable temporary file.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hyprwm/Hyprland
Files changed:
src/plugins/HookSystem.cpp
Commit message: hooksystem: use a random 700 directory for assembler


Vulnerable code:
    std::ofstream ofs("/tmp/hypr/.hookcode.asm", std::ios::trunc);
    std::string ret = execAndGet(
        "cc -x assembler -c /tmp/hypr/.hookcode.asm -o /tmp/hypr/.hookbinary.o 2>&1 && objcopy -O binary -j .text /tmp/hypr/.hookbinary.o /tmp/hypr/.hookbinary2.o 2>&1");
    if (!std::filesystem::exists("/tmp/hypr/.hookbinary2.o")) {
        std::filesystem::remove("/tmp/hypr/.hookcode.asm");
        std::filesystem::remove("/tmp/hypr/.hookbinary.asm");
    std::ifstream ifs("/tmp/hypr/.hookbinary2.o", std::ios::binary);
    std::filesystem::remove("/tmp/hypr/.hookcode.asm");
    std::filesystem::remove("/tmp/hypr/.hookbinary.o");
    std::filesystem::remove("/tmp/hypr/.hookbinary2.o");

Fixed code:
#include "../managers/TokenManager.hpp"
    const auto RANDOMDIR = "/tmp/hypr/" + g_pTokenManager->getRandomUUID();

    if (!std::filesystem::create_directory(RANDOMDIR))
        return {};

    std::filesystem::permissions(RANDOMDIR, std::filesystem::perms::owner_all, std::filesystem::perm_options::replace);

    std::ofstream ofs(RANDOMDIR + "/.hookcode.asm", std::ios::trunc);
    std::string ret = execAndGet(std::string{"cc -x assembler -c " + RANDOMDIR + "/.hookcode.asm -o " + RANDOMDIR + "/.hookbinary.o 2>&1 && objcopy -O binary -j .text " +
                                             RANDOMDIR + "/.hookbinary.o " + RANDOMDIR + "/.hookbinary2.o 2>&1"}
                                     .c_str());
    if (!std::filesystem::exists(RANDOMDIR + "/.hookbinary2.o")) {
        std::filesystem::remove(RANDOMDIR + "/.hookcode.asm");
        std::filesystem::remove(RANDOMDIR + "/.hookbinary.asm");
    std::ifstream ifs(RANDOMDIR + "/.hookbinary2.o", std::ios::binary);
    std::filesystem::remove_all(RANDOMDIR);
CVE-2024-35184 (Python, published 2024-05-15T22:15Z)
Description: value: Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/paperless-ngx/paperless-ngx
Files changed:
src/paperless/auth.py
src/paperless/tests/test_remote_user.py
Commit message: Security: disallow API remote-user auth if disabled (#6739)



Vulnerable code:

Fixed code:
    def process_request(self, request: HttpRequest) -> None:
        # If remote user auth is enabled only for the frontend, not the API,
        # then we need dont want to authenticate the user for API requests.
        if (
            "/api/" in request.path
            and "paperless.auth.PaperlessRemoteUserAuthentication"
            not in settings.REST_FRAMEWORK["DEFAULT_AUTHENTICATION_CLASSES"]
        ):
            return
        return super().process_request(request)

from django.test import override_settings
    @override_settings(
        REST_FRAMEWORK={
            "DEFAULT_AUTHENTICATION_CLASSES": [
                "rest_framework.authentication.BasicAuthentication",
                "rest_framework.authentication.TokenAuthentication",
                "rest_framework.authentication.SessionAuthentication",
            ],
        },
    )
    def test_remote_user_api_disabled(self):
        """
        GIVEN:
            - Configured user
            - Remote user auth enabled for frontend but disabled for the API
            - Note that REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] is set in settings.py in production
        WHEN:
            - API call is made to get documents
        THEN:
            - Call fails
        """
        response = self.client.get(
            "/api/documents/",
            headers={
                "Remote-User": self.user.username,
            },
        )

        self.assertIn(
            response.status_code,
            [status.HTTP_401_UNAUTHORIZED, status.HTTP_403_FORBIDDEN],
        )
CVE-2018-20834 (JavaScript, published 2019-04-30T19:29Z)
Description: value: A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/npm/node-tar
Files changed:
lib/unpack.js
test/unpack.js
Commit message: unpack: only reuse file fs entries if nlink = 1

This matches behavior in bsdtar to prevent overwriting a hardlink with
contents from a File archive entry.


Vulnerable code:
        else if (er || (entry.type === 'File' && !this.unlink && st.isFile()))
      else if (entry.type === 'File' && !this.unlink && st.isFile())

Fixed code:
const ISREUSABLE = Symbol('isReusable')
  // Check if we can reuse an existing filesystem entry safely and
  // overwrite it, rather than unlinking and recreating
  // Windows doesn't report a useful nlink, so we just never reuse entries
  [ISREUSABLE] (entry, st) {
    return entry.type === 'File' &&
      !this.unlink &&
      st.isFile() &&
      st.nlink <= 1 &&
      process.platform !== 'win32'
  }

        else if (er || this[ISREUSABLE](entry, st))
      else if (this[ISREUSABLE](entry, st))

t.test('do not reuse hardlinks, only nlink=1 files', t => {
  const basedir = path.resolve(unpackdir, 'hardlink-reuse')
  mkdirp.sync(basedir)
  t.teardown(() => rimraf.sync(basedir))

  const now = new Date('2018-04-30T18:30:39.025Z')

  const data = makeTar([
    {
      path: 'overwriteme',
      type: 'File',
      size: 4,
      mode: 0o644,
      mtime: now
    },
    'foo\n',
    {
      path: 'link',
      linkpath: 'overwriteme',
      type: 'Link',
      mode: 0o644,
      mtime: now
    },
    {
      path: 'link',
      type: 'File',
      size: 4,
      mode: 0o644,
      mtime: now
    },
    'bar\n',
    '',
    ''
  ])

  const checks = {
    'link': 'bar\n',
    'overwriteme': 'foo\n'
  }

  const check = t => {
    for (let f in checks) {
      t.equal(fs.readFileSync(basedir + '/' + f, 'utf8'), checks[f], f)
      t.equal(fs.statSync(basedir + '/' + f).nlink, 1, f)
    }
    t.end()
  }

  t.test('async', t => {
    const u = new Unpack({ cwd: basedir })
    u.on('close', () => check(t))
    u.end(data)
  })

  t.test('sync', t => {
    const u = new UnpackSync({ cwd: basedir })
    u.end(data)
    check(t)
  })

  t.end()
})
CVE-2020-36620 (C#, published 2022-12-21T19:15Z)
Description: value: A vulnerability was found in Brondahl EnumStringValues up to 4.0.0. It has been declared as problematic. This vulnerability affects the function GetStringValuesWithPreferences_Uncache of the file EnumStringValues/EnumExtensions.cs. The manipulation leads to resource consumption. Upgrading to version 4.0.1 is able to address this issue. The name of the patch is c0fc7806beb24883cc2f9543ebc50c0820297307. It is recommended to upgrade the affected component. VDB-216466 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/Brondahl/EnumStringValues
Files changed:
EnumStringValues/EnumExtensions.cs
Commit message: Protect against DOS attacks made possible by parsing random invalid enum strings


Vulnerable code:
      var typeAppropriateDictionary = parsedEnumStringsDictionaryByType.GetOrAdd(enumTypeObject, (x) => new ConcurrentDictionary<string, Enum>());
      var cachedValue = typeAppropriateDictionary.GetOrAdd(lowerStringValue, (str) =>
      {
        var parseSucceededForDictionary = TryParseStringValueToEnum_Uncached<TEnumType>(lowerStringValue, out var parsedValueForDictionary);
        return parseSucceededForDictionary ? (Enum) parsedValueForDictionary : null;
      });

      if (cachedValue != null)

Fixed code:
      var typeAppropriateDictionary = parsedEnumStringsDictionaryByType.GetOrAdd(
        enumTypeObject, 
        (x) => BuildCacheDictionaryForParseStringValue<TEnumType>()
      );
      if (typeAppropriateDictionary.TryGetValue(lowerStringValue, out var cachedValue))

    private static ConcurrentDictionary<string, Enum> BuildCacheDictionaryForParseStringValue<TEnumType>() where TEnumType : System.Enum
    {
      var dict = new ConcurrentDictionary<string, Enum>();

      foreach (var enumValue in EnumerateValues<TEnumType>())
      {
        foreach (var enumString in GetStringValues<TEnumType>(enumValue))
        {
            // Add to the dictionary, just overwriting if the string is already present.
            // This overwrite is legitimate, because we've declared parsing a duplicate string definition to be `undefined behaviour`.
            dict.AddOrUpdate(enumString.ToLower(), enumValue, ((repeatedString, previousEnumValue) => enumValue));
        }
      }

      return dict;
    }